Merge branch 'develop' into CRL-1766-auth-dm-updates

merging in current develop branch

.circleci/config.yml

@@ -6,6 +6,7 @@
 version: 2.1
 orbs:
   aws-cli: circleci/aws-cli@0.1.19
+  slack: circleci/slack@3.4.2
 
 dependencies:
   cache_directories:
@@ -81,6 +82,27 @@ jobs:
             cd security-content
             source venv/bin/activate
             python bin/doc-gen.py --path . --output docs -v
+      - slack/status:
+          webhook: '${SLACK_WEBHOOK}'
+          fail_only: true
+        
+  test-links:
+    executor: content-executor
+    steps:
+      - run:
+          name: checkout repo
+          command: |
+            if [[ ! -z "${CIRCLE_PULL_REQUEST}" &&  ! -z "${CIRCLE_PR_NUMBER}" ]]; then
+                git clone https://${GITHUB_TOKEN}@github.com/splunk/security-content.git
+                cd security-content
+                git fetch origin pull/${CIRCLE_PR_NUMBER}/head:${CIRCLE_BRANCH}
+                git checkout ${CIRCLE_BRANCH}
+            elif [ "${CIRCLE_BRANCH}" == "" ]; then
+                git clone https://${GITHUB_TOKEN}@github.com/splunk/security-content.git
+            else
+                git clone --branch ${CIRCLE_BRANCH} https://${GITHUB_TOKEN}@github.com/splunk/security-content.git
+            fi
+      - run: *apt-install
       - run:
           name: check for broken links using liche
           command: |
@@ -92,8 +114,12 @@ jobs:
             source $BASH_ENV
             go get -u github.com/raviqqe/liche
             cd security-content
-            liche docs/stories_categories.md -v -t 45
-            liche README.md -v -t 45
+            liche docs/stories_categories.md -v -t 60
+            liche README.md -v -t 60
+      - slack/status:
+          webhook: '${SLACK_WEBHOOK}'
+          fail_only: true
+        
   build-sources:
     executor: content-executor
     steps:
@@ -159,6 +185,10 @@ jobs:
           root: security-content/
           paths:
               - content-pack-build.tar.gz
+      - slack/status:
+          fail_only: true
+          webhook: '${SLACK_WEBHOOK}'
+        
   build-package:
     executor: content-executor
     steps:
@@ -196,6 +226,10 @@ jobs:
           root: ~/dist
           paths:
              - DA-ESS-ContentUpdate-latest.tar.gz
+      - slack/status:
+          fail_only: true
+          webhook: '${SLACK_WEBHOOK}'
+        
   run-appinspect:
     executor: content-executor
     steps:
@@ -228,6 +262,10 @@ jobs:
           root: ~/
           paths:
              - DA-ESS-ContentUpdate-latest.tar.gz
+      - slack/status:
+          fail_only: true
+          webhook: '${SLACK_WEBHOOK}'
+        
   community-api-update:
     executor: aws-cli/default
     steps:
@@ -311,6 +349,10 @@ jobs:
           root: ~/
           paths:
               - DA-ESS-ContentUpdate-latest.tar.gz
+      - slack/status:
+          fail_only: true
+          webhook: '${SLACK_WEBHOOK}'
+        
   publish-github-release:
     docker:
       - image: cibuilds/github:0.10
@@ -326,6 +368,10 @@ jobs:
           root: ~/
           paths:
               - DA-ESS-ContentUpdate-latest.tar.gz
+      - slack/status:
+          fail_only: true
+          webhook: '${SLACK_WEBHOOK}'
+        
   attack-range-update:
     executor: aws-cli/default
     steps:
@@ -339,6 +385,10 @@ jobs:
             aws s3 cp ~/DA-ESS-ContentUpdate-latest.tar.gz s3://attack-range-appbinaries/
             # make the file public since it is not by default
             aws s3api put-object-acl --bucket attack-range-appbinaries --key DA-ESS-ContentUpdate-latest.tar.gz --acl public-read
+      - slack/status:
+          fail_only: true
+          webhook: '${SLACK_WEBHOOK}'
+        
   master-api-update:
     executor: aws-cli/default
     steps:
@@ -366,8 +416,23 @@ jobs:
             aws s3 cp lookups s3://security-content/lookups --recursive --exclude "*" --include "*.csv"
             aws s3 cp macros s3://security-content/macros --recursive --exclude "*" --include "*.yml"
             aws s3 cp deployments s3://security-content/deployments --recursive --exclude "*" --include "*.yml"
+      - slack/status:
+          fail_only: true
+          webhook: '${SLACK_WEBHOOK}'
+        
 workflows:
   version: 2.1
+  test-dead-links:
+    triggers:
+      - schedule:
+          cron: "0 0 * * *"
+          filters:
+            branches:
+              only:
+                - master
+                - develop
+    jobs:
+      - test-links
   validate-and-build:
     jobs:
       - validate-content:

baselines/previously_seen_zoom_child_processes_initial.yml

@@ -0,0 +1,20 @@
+name: Previously Seen Zoom Child Processes - Initial
+id: 60b9c00f-a9d6-4e51-803c-5d63ea21b95b
+version: 1
+date: '2020-05-20'
+description: This search returns the first and last time a process was seen per endpoint with
+    a parent process of zoom.exe (Windows) or zoom.us (macOS). This table is outputed to disk.
+how_to_implement: You must be ingesting endpoint data that tracks process activity,
+  including parent-child relationships from your endpoints, to populate the Endpoint
+  data model in the Processes node.
+author: David Dorsey, Splunk
+search: '| tstats `security_content_summariesonly` min(_time) as firstTimeSeen max(_time) as lastTimeSeen
+        from datamodel=Endpoint.Processes where (Processes.parent_process_name=zoom.exe OR Processes.parent_process_name=zoom.us)
+        by Processes.process_name Processes.dest| `drop_dm_object_name(Processes)`
+        | table dest, process_name, firstTimeSeen, lastTimeSeen
+        | outputlookup zoom_first_time_child_process'
+tags:
+  analytics_story:
+  - Suspicious Zoom Child Processes
+  detections:
+  - First Time Seen Child Process of Zoom

baselines/previously_seen_zoom_child_processes_update.yml

@@ -0,0 +1,25 @@
+name: Previously Seen Zoom Child Processes - Update
+id: 80aea7fd-5da2-4533-b3c2-560533bfbaee
+version: 1
+date: '2020-05-20'
+description: This search returns the first and last time a process was seen per endpoint with
+    a parent process of zoom.exe (Windows) or zoom.us (macOS) within the last hour. It then updates
+    this information with historical data and filters out proces_name and endpoint pairs that have not
+    been seen within the specified time window. This updated table is outputed to disk.
+how_to_implement: You must be ingesting endpoint data that tracks process activity,
+  including parent-child relationships from your endpoints, to populate the Endpoint
+  data model in the Processes node.
+author: David Dorsey, Splunk
+search: '| tstats `security_content_summariesonly` min(_time) as firstTimeSeen max(_time) as lastTimeSeen
+        from datamodel=Endpoint.Processes where (Processes.parent_process_name=zoom.exe OR Processes.parent_process_name=zoom.us)
+        by Processes.process_name Processes.dest| `drop_dm_object_name(Processes)`
+        | table firstTimeSeen, lastTimeSeen, process_name, dest
+        | inputlookup zoom_first_time_child_process append=t
+        | stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by process_name, dest
+        | where lastTimeSeen > relative_time(now(), "`previously_seen_zoom_child_processes_forget_window`")
+        | outputlookup zoom_first_time_child_process'
+tags:
+  analytics_story:
+  - Suspicious Zoom Child Processes
+  detections:
+  - First Time Seen Child Process of Zoom

bin/generate.py

@@ -21,7 +21,6 @@ REPO_PATH = ''
 VERBOSE = False
 OUTPUT_PATH = ''
 
-
 def load_objects(file_path, VERBOSE):
     files = []
     manifest_files = path.join(path.expanduser(REPO_PATH), file_path)
@@ -57,6 +56,22 @@ def generate_transforms_conf(lookups):
 
     return output_path
 
+def generate_collections_conf(lookups):
+    filtered_lookups = list(filter(lambda i: 'collection' in i, lookups))
+    sorted_lookups = sorted(filtered_lookups, key=lambda i: i['name'])
+
+    utc_time = datetime.datetime.utcnow().replace(microsecond=0).isoformat()
+
+    j2_env = Environment(loader=FileSystemLoader('bin/jinja2_templates'),
+                         trim_blocks=True)
+    template = j2_env.get_template('collections.j2')
+    output_path = OUTPUT_PATH + "/default/collections.conf"
+    output = template.render(lookups=sorted_lookups, time=utc_time)
+    with open(output_path, 'w') as f:
+        f.write(output)
+
+    return output_path
+
 
 def generate_savedsearches_conf(detections, response_tasks, baselines, deployments):
 
@@ -152,6 +167,7 @@ def generate_use_case_library_conf(stories, detections, response_tasks, baseline
     sto_res = map_response_tasks_to_stories(response_tasks)
 
     for story in stories:
+        story['author_name'], story['author_company'] = parse_author_company(story)
         if story['name'] in sto_det:
             story['detections'] = list(sto_det[story['name']])
         if story['name'] in sto_res:
@@ -237,6 +253,12 @@ def generate_workbench_panels(response_tasks, stories):
                                      trim_blocks=True)
                 template = j2_env.get_template('panel.j2')
                 output_path = OUTPUT_PATH + "/default/data/ui/panels/workbench_panel_" + response_file_name + ".xml"
+                
+                if response_task['search'].find(">") is not -1:
+                    response_task['search']= response_task['search'].replace(">",">")
+                if response_task['search'].find("<") is not -1:
+                    response_task['search']= response_task['search'].replace("<","&lt;")
+
                 output = template.render(search=response_task['search'])
                 with open(output_path, 'w') as f:
                     f.write(output)
@@ -265,6 +287,22 @@ def parse_data_models_from_search(search):
     return False
 
 
+def parse_author_company(story):
+    match_author = re.search(r'^([^,]+)', story['author'])
+    if match_author is None:
+        match_author = 'no'
+    else:
+        match_author = match_author.group(1)
+
+    match_company = re.search(r',\s?(.*)$', story['author'])
+    if match_company is None:
+        match_company = 'no'
+    else:
+        match_company = match_company.group(1)
+
+    return match_author, match_company
+
+
 def get_deployments(object, deployments):
     matched_deployments = []
 
@@ -496,6 +534,7 @@ if __name__ == "__main__":
         print("WARNING: Generation of Mitre lookup failed.")
 
     lookups_path = generate_transforms_conf(lookups)
+    lookups_path = generate_collections_conf(lookups)
 
     detections = sorted(detections, key=lambda d: d['name'])
     response_tasks = sorted(response_tasks, key=lambda i: i['name'])

bin/jinja2_templates/collections.j2

@@ -0,0 +1,13 @@
+#############
+# Automatically generated by generator.py in splunk/security-content
+# On Date: {{ time }} UTC
+# Author: Splunk Security Research
+# Contact: research@splunk.com
+#############
+
+{% for lookup in lookups %}
+[{{ lookup.name }}]
+enforceTypes = false
+replicate = false
+
+{% endfor %}

bin/jinja2_templates/savedsearches.j2

@@ -94,7 +94,7 @@ search = {{ detection.search }}
 ### ESCU BASELINES ###
 
 {% for baseline in baselines %}
-[ESCU - {{ baseline.name }} - Baseline]
+[ESCU - {{ baseline.name }}]
 action.escu = 0
 action.escu.enabled = 1
 action.escu.search_type = support

bin/jinja2_templates/transforms.j2

@@ -11,6 +11,7 @@
 filename = {{ lookup.filename }}
 {% else %}
 collection = {{ lookup.collection }}
+external_type = kvstore
 {% endif %}
 {% if lookup.default_match is defined %}
 default_match = {{ lookup.default_match }}
@@ -30,5 +31,11 @@ max_matches = {{ lookup.max_matches }}
 {% if lookup.min_matches is defined %}
 min_matches = {{ lookup.min_matches }}
 {% endif %}
+{% if lookup.fields_list is defined %}
+fields_list = {{ lookup.fields_list }}
+{% endif %}
+{% if lookup.filter is defined %}
+filter = {{ lookup.filter }}
+{% endif %}
 
-{% endfor %}
+{% endfor %}

bin/jinja2_templates/use_case_library.j2

@@ -13,7 +13,7 @@ category = {{ story.tags.category[0] }}
 last_updated = {{ story.date }}
 version = {{ story.version }}
 references = {{ story.references | tojson }}
-maintainers = {{ story.author | tojson }}
+maintainers = [{"company": "{{ story.author_company }}", "email": "-", "name": "{{ story.author_name }}"}]
 spec_version = 3
 searches = {{ story.searches | tojson }}
 description = {{ story.description }}

detections/detect_prohibited_applications_spawning_cmd_exe.yml

@@ -24,6 +24,7 @@ tags:
   analytics_story:
   - Suspicious Command-Line Executions
   - Suspicious MSHTA Activity
+  - Suspicious Zoom Child Processes
   mitre_attack_id:
   - T1059
   kill_chain_phases:

detections/first_time_seen_child_process_of_zoom.yml

@@ -0,0 +1,38 @@
+name: First Time Seen Child Process of Zoom
+id: e91bd102-d630-4e76-ab73-7e3ba22c5961
+version: 1
+date: '2020-05-20'
+description: This search looks for child processes spawned by zoom.exe or zoom.us that has not previously been seen.
+how_to_implement: You must be ingesting data that records process activity from your
+  hosts to populate the Endpoint data model in the Processes node. You should run the baseline search `Previously Seen Zoom Child Processes - Initial` to build the initial table of child processes and hostnames for this search to work. You should also schedule at the same interval as this search the second baseline search `Previously Seen Zoom Child Processes - Update` to keep this table up to date and to age out old child processes. Please update the `previously_seen_zoom_child_processes_window` macro to adjust the time window. 
+type: ESCU
+references: []
+author: David Dorsey, Splunk
+search: '| tstats `security_content_summariesonly` min(_time) as firstTime
+        values(Processes.parent_process_name) as parent_process_name
+        values(Processes.parent_process_id) as parent_process_id
+        values(Processes.process_name) as process_name values(Processes.process) as process
+        from datamodel=Endpoint.Processes where (Processes.parent_process_name=zoom.exe OR Processes.parent_process_name=zoom.us)
+        by Processes.process_id Processes.dest 
+        | `drop_dm_object_name(Processes)` 
+        | lookup zoom_first_time_child_process dest as dest process_name as process_name OUTPUT firstTimeSeen 
+        | where isnull(firstTimeSeen) OR firstTimeSeen > relative_time(now(), "`previously_seen_zoom_child_processes_window`")
+        | `security_content_ctime(firstTime)`
+        | table firstTime dest, process_id, process_name, parent_process_id, parent_process_name |`first_time_seen_child_process_of_zoom_filter`'
+known_false_positives: A new child process of zoom isn't malicious by that fact alone. Further investigation of the actions of the child process is needed to verify any malicious behavior is taken.
+tags:
+  analytics_story:
+  - Suspicious Zoom Child Processes
+  mitre_attack_id:
+  - T1068
+  kill_chain_phases:
+  - Actions on Objectives
+  cis20:
+  - CIS 3
+  - CIS 8
+  nist:
+  - PR.PT
+  - DE.CM
+  - PR.IP
+  security_domain: endpoint
+  asset_type: Endpoint

detections/kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace.yml

@@ -0,0 +1,18 @@
+author: "Rod Soto, Splunk"
+date: "2020-05-26"
+description: "This search provides information on Kubernetes service accounts,accessing pods and namespaces by IP address and verb"
+how_to_implement: "You must install the Add-on for Microsoft Cloud Services and Configure Kube-Audit data diagnostics"
+id: 55a2264a-b7f0-45e5-addd-1e5ab3415c72
+known_false_positives: "Not all service accounts interactions are malicious. Analyst must consider IP and verb context when trying to detect maliciousness."
+name: "Kubernetes Azure detect most active service accounts by pod namespace"
+references: []
+search: "sourcetype:mscs:storage:blob:json category=kube-audit | spath input=properties.log | search user.groups{}=system:serviceaccounts*  | table  sourceIPs{} user.username userAgent verb responseStatus.reason responseStatus.status properties.pod objectRef.namespace | top sourceIPs{} user.username verb responseStatus.status properties.pod objectRef.namespace |`kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace_filter`"
+tags:
+  analytics_story:
+    - "Kubernetes Sensitive Role Activity"
+  asset_type: "Azure AKS Kubernetes cluster"
+  kill_chain_phases:
+    - Lateral Movement
+  security_domain: threat
+type: ESCU
+version: 1

detections/kubernetes_azure_detect_rbac_authorization_by_account.yml

@@ -0,0 +1,18 @@
+author: "Rod Soto, Splunk"
+date: "2020-05-26"
+description: "This search provides information on Kubernetes RBAC authorizations by accounts, this search can be modified by adding rare or top to see both extremes of RBAC by accounts occurrences"
+how_to_implement: "You must install the Add-on for Microsoft Cloud Services and Configure Kube-Audit data diagnostics"
+id: 47af7d20-0607-4079-97d7-7a29af58b54e
+known_false_positives: "Not all RBAC Authorications are malicious. RBAC authorizations can uncover malicious activity specially if sensitive Roles have been granted."
+name: "Kubernetes Azure detect RBAC authorization by account"
+references: []
+search: "sourcetype:mscs:storage:blob:json category=kube-audit | spath input=properties.log | search annotations.authorization.k8s.io/reason=* | table sourceIPs{} user.username userAgent annotations.authorization.k8s.io/reason |stats count by user.username annotations.authorization.k8s.io/reason | rare user.username annotations.authorization.k8s.io/reason |`kubernetes_azure_detect_rbac_authorization_by_account_filter`"
+tags:
+  analytics_story:
+    - "Kubernetes Sensitive Role Activity"
+  asset_type: "Azure AKS Kubernetes cluster"
+  kill_chain_phases:
+    - Lateral Movement
+  security_domain: threat
+type: ESCU
+version: 1

detections/kubernetes_azure_detect_sensitive_object_access.yml

@@ -0,0 +1,18 @@
+author: "Rod Soto, Splunk"
+date: "2020-05-20"
+description: "This search provides information on Kubernetes accounts accessing sensitve objects such as configmpas or secrets"
+how_to_implement: "You must install the Add-on for Microsoft Cloud Services and Configure Kube-Audit data diagnostics"
+id: 1bba382b-07fd-4ffa-b390-8002739b76e8
+known_false_positives: "Sensitive object access is not necessarily malicious but user and object context can provide guidance for detection."
+name: "Kubernetes Azure detect sensitive object access"
+references: []
+search: "`kubernetes_azure` category=kube-audit | spath input=properties.log| search objectRef.resource=secrets OR configmaps |table user.username user.groups{} objectRef.resource objectRef.namespace objectRef.name annotations.authorization.k8s.io/reason |dedup user.username user.groups{} |`kubernetes_azure_detect_sensitive_object_access_filter`"
+tags:
+  analytics_story:
+    - "Kubernetes Sensitive Object Access Activity"
+  asset_type: "Azure AKS Kubernetes cluster"
+  kill_chain_phases:
+    - Lateral Movement
+  security_domain: threat
+type: ESCU
+version: 1

detections/kubernetes_azure_detect_sensitive_role_access.yml

@@ -0,0 +1,18 @@
+author: "Rod Soto, Splunk"
+date: "2020-05-20"
+description: "This search provides information on Kubernetes accounts accessing sensitve objects such as configmpas or secrets"
+how_to_implement: "You must install the Add-on for Microsoft Cloud Services and Configure Kube-Audit data diagnostics"
+id: f27349e5-1641-4f6a-9e68-30402be0ad4c
+known_false_positives: "Sensitive role resource access is necessary for cluster operation, however source IP, namespace and user group may indicate possible malicious use. "
+name: "Kubernetes Azure detect sensitive role access"
+references: []
+search: "`kubernetes_azure` category=kube-audit | spath input=properties.log| search objectRef.resource=clusterroles OR clusterrolebindings | table sourceIPs{} user.username user.groups{} objectRef.namespace requestURI annotations.authorization.k8s.io/reason | dedup user.username user.groups{} |`kubernetes_azure_detect_sensitive_role_access_filter`"
+tags:
+  analytics_story:
+    - "Kubernetes Sensitive Role Activity"
+  asset_type: "Azure AKS Kubernetes cluster"
+  kill_chain_phases:
+    - Lateral Movement
+  security_domain: threat
+type: ESCU
+version: 1

detections/kubernetes_azure_detect_service_accounts_forbidden_failure_access.yml

@@ -0,0 +1,18 @@
+author: "Rod Soto, Splunk"
+date: "2020-05-20"
+description: "This search provides information on Kubernetes service accounts with failure or forbidden access status"
+how_to_implement: "You must install the Add-on for Microsoft Cloud Services and Configure Kube-Audit data diagnostics"
+id: 019690d7-420f-4da0-b320-f27b09961514
+known_false_positives: "This search can give false positives as there might be inherent issues with authentications and permissions at cluster."
+name: "Kubernetes Azure detect service accounts forbidden failure access"
+references: []
+search: "`kubernetes_azure` category=kube-audit | spath input=properties.log | search user.groups{}=system:serviceaccounts*  responseStatus.reason=Forbidden | table  sourceIPs{} user.username userAgent verb responseStatus.reason responseStatus.status properties.pod objectRef.namespace  |`kubernetes_azure_detect_service_accounts_forbidden_failure_access_filter`"
+tags:
+  analytics_story:
+    - "Kubernetes Sensitive Object Access Activity"
+  asset_type: "Azure AKS Kubernetes cluster"
+  kill_chain_phases:
+    - Lateral Movement
+  security_domain: threat
+type: ESCU
+version: 1

detections/kubernetes_azure_detect_suspicious_kubectl_calls.yml

@@ -0,0 +1,18 @@
+author: "Rod Soto, Splunk"
+date: "2020-05-26"
+description: "This search provides information on Kubectl calls with IP, verb namespace and object access context"
+how_to_implement: "You must install the Add-on for Microsoft Cloud Services and Configure Kube-Audit data diagnostics"
+id: 4b6d1ba8-0000-4cec-87e6-6cbbd71651b5
+known_false_positives: "Kubectl calls are not malicious by nature. However source IP, verb and Object can reveal potential malicious activity, specially suspicious IPs and sensitive objects such as configmaps or secrets"
+name: "Kubernetes Azure detect suspicious kubectl calls"
+references: []
+search: "`kubernetes_azure` category=kube-audit | spath input=properties.log| search objectRef.resource=secrets OR configmaps |table user.username user.groups{} objectRef.resource objectRef.namespace objectRef.name annotations.authorization.k8s.io/reason |dedup user.username user.groups{} |`kubernetes_azure_detect_suspicious_kubectl_calls_filter`"
+tags:
+  analytics_story:
+    - "Kubernetes Sensitive Object Access Activity"
+  asset_type: "Azure AKS Kubernetes cluster"
+  kill_chain_phases:
+    - Lateral Movement
+  security_domain: threat
+type: ESCU
+version: 1

detections/kubernetes_azure_pod_scan_fingerprint.yml

@@ -0,0 +1,18 @@
+author: "Rod Soto, Splunk"
+date: "2020-05-20"
+description: "This search provides information of unauthenticated requests via source IP user agent, request URI and response status data against Kubernetes cluster pod in Azure"
+how_to_implement: "You must install the Add-on for Microsoft Cloud Services and Configure Kube-Audit data diagnostics"
+id: 86aad3e0-732f-4f66-bbbc-70df448e461d
+known_false_positives: "Not all unauthenticated requests are malicious, but source IPs, userAgent, verb, request URI and response status will provide context."
+name: "Kubernetes Azure pod scan fingerprint"
+references: []
+search: "`kubernetes_azure` category=kube-audit | spath input=properties.log | search responseStatus.code=401 | table  sourceIPs{} userAgent verb requestURI responseStatus.reason properties.pod |`kubernetes_azure_pod_scan_fingerprint_filter`"
+tags:
+  analytics_story:
+    - "Kubernetes Scanning Activity"
+  asset_type: "Azure AKS Kubernetes cluster"
+  kill_chain_phases:
+    - Reconnaissance
+  security_domain: threat
+type: ESCU
+version: 1

detections/kubernetes_azure_scan_fingerprint.yml

@@ -0,0 +1,18 @@
+author: "Rod Soto, Splunk"
+date: "2020-05-19"
+description: "This search provides information of unauthenticated requests via source IP user agent, request URI and response status data against Kubernetes cluster in Azure"
+how_to_implement: "You must install the Add-on for Microsoft Cloud Services and Configure Kube-Audit data diagnostics"
+id: c5e5bd5c-1013-4841-8b23-e7b3253c840a
+known_false_positives: "Not all unauthenticated requests are malicious, but source IPs, userAgent, verb, request URI and response status will provide context."
+name: "Kubernetes Azure scan fingerprint"
+references: []
+search: "`kubernetes_azure` category=kube-audit | spath input=properties.log | search responseStatus.code=401 | table  sourceIPs{} userAgent verb requestURI responseStatus.reason |`kubernetes_azure_scan_fingerprint_filter`"
+tags:
+  analytics_story:
+    - "Kubernetes Scanning Activity"
+  asset_type: "Azure AKS Kubernetes cluster"
+  kill_chain_phases:
+    - Reconnaissance
+  security_domain: threat
+type: ESCU
+version: 1

docs/README.md

@@ -1,9 +1,9 @@
-# Welcome to Splunk Security Research! 
+# Splunk Security Content 
 ![](static/logo.png) 
 
-Thanks for stopping by the Splunk Security Research Team's resource portal! Here you'll find background and links to our security content and other related tools.
+Welcome to the Splunk Security Content
 
-Splunk security content is organized into "Analytic Stories," themed security guides that provide background on TTPs, mapped to the MITRE framework, the Lockheed Martin Kill Chain, and CIS controls. They include Splunk searches, machine-learning algorithms, and Splunk Phantom playbooks (where available)—all built to work together to detect, investigate, and respond to threats. The other apps were designed to help you derive more value from this content. 
+This project gives you access to our repository of Analytic Stories that are security guides which provide background on TTPs, mapped to the MITRE framework, the Lockheed Martin Kill Chain, and CIS controls. They include Splunk searches, machine-learning algorithms, and Splunk Phantom playbooks (where available)—all designed to work together to detect, investigate, and respond to threats.
 
 ## View Our Content
 You can review our Analytic Stories by category [here](stories_categories.md), or in our [Splunk App](https://github.com/splunk/security-content/releases). 
@@ -13,21 +13,13 @@ If you prefer working with the command line, check out our [API](https://docs.sp
 ```
 curl -s https://content.splunkresearch.com | jq
 {
-  "hello": "welcome to Splunks Research security content api",
-  "available_endpoints": [
-    "/stories",
-    "/detections",
-    "/investigations",
-    "/baselines",
-    "/responses",
-    "/package"
-  ]
+  "hello": "welcome to Splunks Research security content api"
 }
 ```
 
 ## Getting Started
 
-Once you've cloned the security-content repo, we recommend using our Analytic Story Execution App [(ASX)](https://github.com/splunk/analytics_story_execution) to execute all of the searches, machine-learning models, and Splunk Phantom playbooks in the story automatically.   
+Once you've installed our [app](https://github.com/splunk/security-content/releases), we recommend using our Analytic Story Execution App [(ASX)](https://github.com/splunk/analytics_story_execution) to execute and schedule all of the detections a story automatically.   
 
 ## Test Out The Detections
 The [attack_range](https://http://github.com/splunk/attack_range) project allows you to spin up an enviroment and launch attacks against it to test the detections. 
@@ -36,15 +28,25 @@ The [attack_range](https://http://github.com/splunk/attack_range) project allows
 If you get stuck or need help with any of our tools, see our [support options](https://github.com/splunk/security-content#support). 
 
 ## Contribute Content
-If you want to help the rest of the security community by sharing your own detections, see our [contributor guide](https://github.com/splunk/security-content#Contributing). Digital defenders unite!
+If you want to help the rest of the security community by sharing your own detections, see our [contributor guide](https://github.com/splunk/security-content/blob/develop/docs/CONTRIBUTING.md). Digital defenders unite!
 
 
-## Content Spec Documentation 
-* [Story](spec/story.spec.md)
-* [Detections](spec/detections.spec.md) 
-* [Investigations](spec/investigations.spec.md) 
-* [Responses](spec/responses.spec.md) 
-* [Baselines](spec/baselines.spec.md)
+## Content Parts
+* [stories/](stories/): All Analytic Stories
+* [detections/](detections/): Splunk Enterprise, Splunk UBA, and Splunk Phantom detections that power Analytic Stories
+* [response_tasks/](response_tasks/): Splunk Enterprise and Splunk Phantom investigative searches and playbooks employed by Analytic Stories
+* [responses/](responses/): Automated Splunk Enterprise and Splunk Phantom responses triggered by Analytic Stories
+* [baselines/](baselines/): Splunk Phantom and Splunk Enterprise baseline searches needed to support detection searches in Analytic Stories
+
+#### Content Spec Files
+* [stories](docs/spec/stories.spec.md) 
+* [detections](docs/spec/detections.spec.md)
+* [deployments](docs/spec/deployments.spec.md)
+* [responses](docs/spec/responses.spec.md)
+* [response_tasks](docs/spec/response_tasks.spec.md)
+* [baselines](docs/spec/baselines.spec.md)
+* [lookups](docs/spec/lookups.spec.md)
+* [macros](docs/spec/macros.spec.md)
 
 
 

docs/spec/baselines.spec.json

@@ -0,0 +1,107 @@
+{
+  "$id": "http://example.com/example.json",
+  "$schema": "http://json-schema.org/draft-07/schema",
+  "additionalProperties": true,
+  "description": "schema for baselines",
+  "properties": {
+    "author": {
+      "$id": "#/properties/author",
+      "default": "",
+      "description": "Author of the baseline",
+      "examples": [
+        "Bahvin Patel, Splunk"
+      ],
+      "type": "string"
+    },
+    "date": {
+      "$id": "#/properties/date",
+      "default": "",
+      "description": "date of creation or modification, format yyyy-mm-dd",
+      "examples": [
+        "2019-12-06"
+      ],
+      "type": "string"
+    },
+    "description": {
+      "$id": "#/properties/description",
+      "default": "",
+      "description": "A detailed description of the baseline ",
+      "examples": [
+        "This search looks for CloudTrail events where an AWS instance is started and creates a baseline of most recent time (latest) and the first time (earliest) we've seen this region in our dataset grouped by the value awsRegion for the last 30 days"
+      ],
+      "type": "string"
+    },
+    "how_to_implement": {
+      "$id": "#/properties/how_to_implement",
+      "default": "",
+      "description": "information about how to implement. Only needed for non standard implementations.",
+      "examples": [
+        "This search requires Sysmon Logs and a Sysmon configuration, which includes EventCode 10 for lsass.exe."
+      ],
+      "type": "string"
+    },
+    "id": {
+      "$id": "#/properties/id",
+      "default": "",
+      "description": "UUID as unique identifier",
+      "examples": [
+        "fc0edc95-ff2b-48b0-9f6f-63da3789fd63"
+      ],
+      "type": "string"
+    },
+    "name": {
+      "$id": "#/properties/name",
+      "default": "",
+      "examples": [
+        "Previously Seen AWS Regions"
+      ],
+      "title": "Name of baseline",
+      "type": "string"
+    },
+    "search": {
+      "$id": "#/properties/search",
+      "default": "",
+      "description": "The Splunk search for the baseline",
+      "examples": [
+        "cloudtrail StartInstances | stats earliest(_time) as earliest latest(_time) as latest by awsRegion | outputlookup previously_seen_aws_regions.csv"
+      ],
+      "type": "string"
+    },
+    "tags": {
+      "$id": "#/properties/tags",
+      "additionalProperties": true,
+      "default": {},
+      "description": "An array of key value pairs for tagging",
+      "examples": [
+        {
+          "analytics_story": "suspicious_aws_ec2_activities",
+          "custom_key": "custom_value"
+        }
+      ],
+      "minItems": 1,
+      "type": "object",
+      "uniqueItems": true
+    },
+    "version": {
+      "$id": "#/properties/version",
+      "default": 0,
+      "description": "version of baseline, e.g. 1 or 2 ...",
+      "examples": [
+        1
+      ],
+      "type": "integer"
+    }
+  },
+  "required": [
+    "name",
+    "id",
+    "version",
+    "date",
+    "description",
+    "author",
+    "search",
+    "tags"
+  ],
+  "title": "Baseline Schema",
+  "type": "object"
+}

docs/spec/deployments.spec.json

@@ -0,0 +1,264 @@
+{
+  "$id": "http://example.com/example.json",
+  "$schema": "http://json-schema.org/draft-07/schema",
+  "additionalProperties": true,
+  "default": {},
+  "description": "schema for deployment",
+  "properties": {
+    "alert_action": {
+      "$id": "#/properties/alert_action",
+      "additionalProperties": true,
+      "default": {},
+      "description": "Set alert action parameter for search",
+      "examples": [
+        {
+          "email": {
+            "message": "Splunk Alert $name$ triggered %fields%",
+            "subject": "Splunk Alert $name$",
+            "to": "test@test.com"
+          },
+          "index": {
+            "name": "asx"
+          },
+          "notable": {
+            "rule_description": "%description%",
+            "rule_title": "%name%"
+          }
+        }
+      ],
+      "properties": {
+        "email": {
+          "$id": "#/properties/alert_action/properties/email",
+          "additionalProperties": true,
+          "default": {},
+          "description": "By enabling it, an email is sent with the results",
+          "examples": [
+            {
+              "message": "Splunk Alert $name$ triggered %fields%",
+              "subject": "Splunk Alert $name$",
+              "to": "test@test.com"
+            }
+          ],
+          "properties": {
+            "message": {
+              "$id": "#/properties/alert_action/properties/email/properties/message",
+              "default": "",
+              "description": "message of email",
+              "examples": [
+                "Splunk Alert $name$ triggered %fields%"
+              ],
+              "type": "string"
+            },
+            "subject": {
+              "$id": "#/properties/alert_action/properties/email/properties/subject",
+              "default": "",
+              "description": "Subject of email",
+              "examples": [
+                "Splunk Alert $name$"
+              ],
+              "type": "string"
+            },
+            "to": {
+              "$id": "#/properties/alert_action/properties/email/properties/to",
+              "default": "",
+              "description": "Recipient of email",
+              "examples": [
+                "test@test.com"
+              ],
+              "type": "string"
+            }
+          },
+          "required": [
+            "to",
+            "subject",
+            "message"
+          ],
+          "type": "object"
+        },
+        "index": {
+          "$id": "#/properties/alert_action/properties/index",
+          "additionalProperties": true,
+          "default": {},
+          "description": "By enabling it, the results are stored in another index",
+          "examples": [
+            {
+              "name": "asx"
+            }
+          ],
+          "properties": {
+            "name": {
+              "$id": "#/properties/alert_action/properties/index/properties/name",
+              "default": "",
+              "description": "Name of the index",
+              "examples": [
+                "asx"
+              ],
+              "type": "string"
+            }
+          },
+          "required": [
+            "name"
+          ],
+          "type": "object"
+        },
+        "notable": {
+          "$id": "#/properties/alert_action/properties/notable",
+          "additionalProperties": true,
+          "default": {},
+          "description": "By enabling it, a notable is generated",
+          "examples": [
+            {
+              "rule_description": "%description%",
+              "rule_title": "%name%"
+            }
+          ],
+          "properties": {
+            "rule_description": {
+              "$id": "#/properties/alert_action/properties/notable/properties/rule_description",
+              "default": "",
+              "description": "Rule description of the notable event",
+              "examples": [
+                "%description%"
+              ],
+              "type": "string"
+            },
+            "rule_title": {
+              "$id": "#/properties/alert_action/properties/notable/properties/rule_title",
+              "default": "",
+              "description": "Rule title of the notable event",
+              "examples": [
+                "%name%"
+              ],
+              "type": "string"
+            }
+          },
+          "required": [
+            "rule_title",
+            "rule_description"
+          ],
+          "type": "object"
+        }
+      },
+      "type": "object"
+    },
+    "date": {
+      "$id": "#/properties/date",
+      "default": "",
+      "description": "date of creation or modification, format yyyy-mm-dd",
+      "examples": [
+        "2019-12-06"
+      ],
+      "type": "string"
+    },
+    "description": {
+      "$id": "#/properties/description",
+      "default": "",
+      "description": "description of the deployment configuration",
+      "examples": [
+        "This deployment configuration provides a standard scheduling policy over all rules."
+      ],
+      "type": "string"
+    },
+    "id": {
+      "$id": "#/properties/id",
+      "default": "",
+      "description": "uuid as unique identifier",
+      "examples": [
+        "fb4c31b0-13e8-4155-8aa5-24de4b8d6717"
+      ],
+      "type": "string"
+    },
+    "name": {
+      "$id": "#/properties/name",
+      "default": "",
+      "description": "Name of deployment configuration",
+      "examples": [
+        "Deployment Configuration all Detections"
+      ],
+      "type": "string"
+    },
+    "scheduling": {
+      "$id": "#/properties/scheduling",
+      "additionalProperties": true,
+      "default": {},
+      "description": "allows to set scheduling parameter",
+      "examples": [
+        {
+          "cron_schedule": "*/10 * * * *",
+          "earliest_time": "-10m",
+          "latest_time": "now",
+          "schedule_window": "auto"
+        }
+      ],
+      "properties": {
+        "cron_schedule": {
+          "$id": "#/properties/scheduling/properties/cron_schedule",
+          "default": "",
+          "description": "Cron schedule to schedule the Splunk searches.",
+          "examples": [
+            "*/10 * * * *"
+          ],
+          "type": "string"
+        },
+        "earliest_time": {
+          "$id": "#/properties/scheduling/properties/earliest_time",
+          "default": "",
+          "description": "earliest time of search",
+          "examples": [
+            "-10m"
+          ],
+          "type": "string"
+        },
+        "latest_time": {
+          "$id": "#/properties/scheduling/properties/latest_time",
+          "default": "",
+          "description": "latest time of search",
+          "examples": [
+            "now"
+          ],
+          "type": "string"
+        },
+        "schedule_window": {
+          "$id": "#/properties/scheduling/properties/schedule_window",
+          "default": "",
+          "description": "schedule window for search",
+          "examples": [
+            "auto"
+          ],
+          "type": "string"
+        }
+      },
+      "required": [
+        "cron_schedule",
+        "earliest_time",
+        "latest_time"
+      ],
+      "type": "object"
+    },
+    "tags": {
+      "$id": "#/properties/tags",
+      "additionalProperties": true,
+      "default": {},
+      "description": "An array of key value pairs for tagging",
+      "examples": [
+        {
+          "analytics_story": "credential_dumping"
+        }
+      ],
+      "minItems": 1,
+      "type": "object",
+      "uniqueItems": true
+    }
+  },
+  "required": [
+    "name",
+    "id",
+    "date",
+    "description",
+    "scheduling",
+    "alert_action",
+    "tags"
+  ],
+  "title": "Deployment Schema",
+  "type": "object"
+}

docs/spec/detections.spec.json

@@ -0,0 +1,157 @@
+{
+  "$id": "http://example.com/example.json",
+  "$schema": "http://json-schema.org/draft-07/schema",
+  "additionalProperties": true,
+  "description": "schema for detections",
+  "properties": {
+    "author": {
+      "$id": "#/properties/author",
+      "default": "",
+      "description": "Author of the detection",
+      "examples": [
+        "Patrick Bareiss, Splunk"
+      ],
+      "type": "string"
+    },
+    "date": {
+      "$id": "#/properties/date",
+      "default": "",
+      "description": "date of creation or modification, format yyyy-mm-dd",
+      "examples": [
+        "2019-12-06"
+      ],
+      "type": "string"
+    },
+    "description": {
+      "$id": "#/properties/description",
+      "default": "",
+      "description": "A detailed description of the detection",
+      "examples": [
+        "dbgcore.dll is a specifc DLL for Windows core debugging. It is used to obtain a memory dump of a process. This search detects the usage of this DLL for creating a memory dump of LSASS process. Memory dumps of the LSASS process can be created with tools such as Windows Task Manager or procdump."
+      ],
+      "type": "string"
+    },
+    "how_to_implement": {
+      "$id": "#/properties/how_to_implement",
+      "default": "",
+      "description": "information about how to implement. Only needed for non standard implementations.",
+      "examples": [
+        "This search requires Sysmon Logs and a Sysmon configuration, which includes EventCode 10 for lsass.exe."
+      ],
+      "type": "string"
+    },
+    "id": {
+      "$id": "#/properties/id",
+      "default": "",
+      "description": "UUID as unique identifier",
+      "examples": [
+        "fb4c31b0-13e8-4155-8aa5-24de4b8d6717"
+      ],
+      "type": "string"
+    },
+    "known_false_positives": {
+      "$id": "#/properties/knwon_false_positives",
+      "default": "",
+      "description": "known false postives",
+      "examples": [
+        "Administrators can create memory dumps for debugging purposes, but memory dumps of the LSASS process would be unusual."
+      ],
+      "type": "string"
+    },
+    "name": {
+      "$id": "#/properties/name",
+      "default": "",
+      "examples": [
+        "Access LSASS Memory for Dump Creation"
+      ],
+      "title": "Name of detection",
+      "type": "string"
+    },
+    "references": {
+      "$id": "#/properties/references",
+      "additionalItems": true,
+      "default": [],
+      "description": "A list of references for this detection",
+      "examples": [
+        [
+          "https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf"
+        ]
+      ],
+      "items": {
+        "$id": "#/properties/references/items",
+        "default": "",
+        "description": "An explanation about the purpose of this instance.",
+        "examples": [
+          "https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf"
+        ],
+        "title": "The Items Schema",
+        "type": "string"
+      },
+      "type": "array"
+    },
+    "search": {
+      "$id": "#/properties/search",
+      "default": "",
+      "description": "The Splunk search for the detection",
+      "examples": [
+        "`sysmon` EventCode=10 TargetImage=*lsass.exe CallTrace=*dbgcore.dll* OR CallTrace=*dbghelp.dll* | stats count min(_time) as firstTime max(_time) as lastTime by Computer, TargetImage, TargetProcessId, SourceImage, SourceProcessId | rename Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `access_lsass_memory_for_dump_creation_filter`"
+      ],
+      "type": "string"
+    },
+    "tags": {
+      "$id": "#/properties/tags",
+      "additionalProperties": true,
+      "default": {},
+      "description": "An array of key value pairs for tagging",
+      "examples": [
+        {
+          "analytics_story": "credential_dumping",
+          "custom_key": "custom_value"
+        }
+      ],
+      "minItems": 1,
+      "type": "object",
+      "uniqueItems": true
+    },
+    "type": {
+      "$id": "#/properties/type",
+      "default": "",
+      "description": "type of detection",
+      "examples": [
+        "ESCU"
+      ],
+      "items": {
+        "enum": [
+          "ESCU",
+          "SSE",
+          "RBA"
+        ],
+        "type": "string"
+      },
+      "type": "string"
+    },
+    "version": {
+      "$id": "#/properties/version",
+      "default": 0,
+      "description": "version of detection, e.g. 1 or 2 ...",
+      "examples": [
+        2
+      ],
+      "type": "integer"
+    }
+  },
+  "required": [
+    "name",
+    "id",
+    "version",
+    "date",
+    "description",
+    "type",
+    "author",
+    "search",
+    "known_false_positives",
+    "tags"
+  ],
+  "title": "Detection Schema",
+  "type": "object"
+}

docs/spec/lookups.spec.json

@@ -0,0 +1,88 @@
+{
+  "$id": "https://api.splunkresearch.com/schemas/lookups.json",
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "description": "A object that defines a lookup file and its properties.",
+  "oneOf": [
+    {
+      "required": [
+        "collection"
+      ]
+    },
+    {
+      "required": [
+        "filename"
+      ]
+    }
+  ],
+  "properties": {
+    "case_sensitive_match": {
+      "description": "What the macro is intended to filter",
+      "enum": [
+        "true",
+        "false"
+      ],
+      "examples": [
+        "true"
+      ],
+      "type": "string"
+    },
+    "collection": {
+      "description": "Name of the collection to use for this lookup",
+      "examples": [
+        "prohibited_apps_launching_cmd"
+      ],
+      "type": "string"
+    },
+    "default_match": {
+      "description": "The default value if no match is found",
+      "examples": [
+        "true"
+      ],
+      "type": "string"
+    },
+    "description": {
+      "description": "The description of this lookup",
+      "examples": [
+        "This lookup contains file names that exist in the Windows\\System32 directory"
+      ],
+      "type": "string"
+    },
+    "filename": {
+      "description": "The name of the file to use for this lookup",
+      "examples": [
+        "prohibited_apps_launching_cmd.csv"
+      ],
+      "type": "string"
+    },
+    "match_type": {
+      "description": "A comma and space-delimited list of <match_type>(<field_name>) specification to allow for non-exact matching",
+      "examples": [
+        "WILDCARD(process)"
+      ],
+      "type": "string"
+    },
+    "max_matches": {
+      "description": "The maximum number of possible matches for each input lookup value",
+      "examples": [
+        "100"
+      ],
+      "type": "integer"
+    },
+    "min_matches": {
+      "description": "Minimum number of possible matches for each input lookup value",
+      "examples": [
+        "1"
+      ],
+      "type": "integer"
+    },
+    "name": {
+      "description": "The name of the lookup to be used in searches",
+      "examples": [
+        "isWindowsSystemFile_lookup"
+      ],
+      "type": "string"
+    }
+  },
+  "title": "Lookup Manifest",
+  "type": "object"
+}

docs/spec/macros.spec.json

@@ -0,0 +1,43 @@
+{
+  "$id": "https://api.splunkresearch.com/schemas/macros.json",
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "description": "An object that defines the parameters for a Splunk Macro",
+  "properties": {
+    "arguments": {
+      "description": "A list of the arguments being passed to this macro",
+      "items": {
+        "type": "string"
+      },
+      "minItems": 0,
+      "type": "array",
+      "uniqueItems": true
+    },
+    "definition": {
+      "description": "The macro definition",
+      "examples": [
+        "(query=fls-na* AND query = www* AND query=images*)"
+      ],
+      "type": "string"
+    },
+    "description": {
+      "description": "What the macro is intended to filter",
+      "examples": [
+        "Use this macro to filter out known good objects"
+      ],
+      "type": "string"
+    },
+    "name": {
+      "description": "The name of the macro",
+      "examples": [
+        "detection_search_output_filter"
+      ],
+      "type": "string"
+    }
+  },
+  "required": [
+    "name",
+    "description"
+  ],
+  "title": "Macro Manifest",
+  "type": "object"
+}

docs/spec/response_tasks.spec.json

@@ -0,0 +1,159 @@
+{
+  "$id": "http://example.com/example.json",
+  "$schema": "http://json-schema.org/draft-07/schema",
+  "additionalProperties": true,
+  "default": {},
+  "description": "schema for response tasks",
+  "properties": {
+    "author": {
+      "$id": "#/properties/author",
+      "default": "",
+      "description": "Author of response task",
+      "examples": [
+        "Patrick Barei\u00df, Splunk"
+      ],
+      "type": "string"
+    },
+    "dashboard": {
+      "$id": "#/properties/dashboard",
+      "default": "",
+      "description": "Name of dashboard used as response task",
+      "examples": [
+        "process_chain_analysis.json"
+      ],
+      "type": "string"
+    },
+    "date": {
+      "$id": "#/properties/date",
+      "default": "",
+      "description": "date of creation or modification, format yyyy-mm-dd",
+      "examples": [
+        "2019-12-06"
+      ],
+      "type": "string"
+    },
+    "description": {
+      "$id": "#/properties/description",
+      "default": "",
+      "description": "Description of response task",
+      "examples": [
+        "Response Task example description"
+      ],
+      "type": "string"
+    },
+    "how_to_implement": {
+      "$id": "#/properties/how_to_implement",
+      "default": "",
+      "description": "information about how to implement. Only needed for non standard implementations.",
+      "examples": [
+        "This search requires Sysmon Logs and a Sysmon configuration, which includes EventCode 10 for lsass.exe."
+      ],
+      "type": "string"
+    },
+    "id": {
+      "$id": "#/properties/id",
+      "default": "",
+      "description": "UUID as unique identifier",
+      "examples": [
+        "fb4c31b0-13e8-4155-8aa5-24de4b8d6717"
+      ],
+      "type": "string"
+    },
+    "inputs": {
+      "$id": "#/properties/inputs",
+      "default": [],
+      "description": "Inputs used from the response task",
+      "examples": [
+        [
+          "lookup_file"
+        ]
+      ],
+      "type": "array"
+    },
+    "name": {
+      "$id": "#/properties/name",
+      "default": "",
+      "description": "Namo fo response task",
+      "examples": [
+        "Response Tas Example"
+      ],
+      "type": "string"
+    },
+    "playbook": {
+      "$id": "#/properties/playbook",
+      "additionalProperties": true,
+      "default": {},
+      "description": "A phantom playbook as response task",
+      "examples": [
+        {
+          "name": "lets_encrypt_domain_investigate.json",
+          "url_json": "https://github.com/phantomcyber/playbooks/blob/4.6/lets_encrypt_domain_investigate.json",
+          "url_python": "https://github.com/phantomcyber/playbooks/blob/4.6/lets_encrypt_domain_investigate.py"
+        }
+      ],
+      "properties": {
+        "name": {
+          "$id": "#/properties/playbook/properties/name",
+          "default": "",
+          "description": "Name of Phantom Playbook",
+          "examples": [
+            "lets_encrypt_domain_investigate.json"
+          ],
+          "type": "string"
+        },
+        "url_json": {
+          "$id": "#/properties/playbook/properties/url_json",
+          "default": "",
+          "description": "URL for phantom playbook json file",
+          "examples": [
+            "https://github.com/phantomcyber/playbooks/blob/4.6/lets_encrypt_domain_investigate.json"
+          ],
+          "type": "string"
+        },
+        "url_python": {
+          "$id": "#/properties/playbook/properties/url_python",
+          "default": "",
+          "description": "URL for phantom playbook python file",
+          "examples": [
+            "https://github.com/phantomcyber/playbooks/blob/4.6/lets_encrypt_domain_investigate.py"
+          ],
+          "type": "string"
+        }
+      },
+      "required": [
+        "name",
+        "url_json",
+        "url_python"
+      ],
+      "type": "object"
+    },
+    "search": {
+      "$id": "#/properties/search",
+      "default": "",
+      "description": "Search as response task",
+      "examples": [
+        "`sysmon` EventCode=1 | search [| inputlookup %lookup_file% ] | stats count by dest user process_name"
+      ],
+      "type": "string"
+    },
+    "version": {
+      "$id": "#/properties/version",
+      "default": 0,
+      "description": "version of detection, e.g. 1 or 2 ...",
+      "examples": [
+        3
+      ],
+      "type": "integer"
+    }
+  },
+  "required": [
+    "name",
+    "id",
+    "version",
+    "date",
+    "description",
+    "author"
+  ],
+  "title": "Response Task Schema",
+  "type": "object"
+}

docs/spec/responses.spec.json

@@ -0,0 +1,117 @@
+{
+  "$id": "http://example.com/example.json",
+  "$schema": "http://json-schema.org/draft-07/schema",
+  "additionalProperties": true,
+  "default": {},
+  "description": "schema for response",
+  "properties": {
+    "author": {
+      "$id": "#/properties/author",
+      "default": "",
+      "description": "Author of the response",
+      "examples": [
+        "Rico Valdez, Patrick Barei\u00df, Splunk"
+      ],
+      "type": "string"
+    },
+    "date": {
+      "$id": "#/properties/date",
+      "default": "",
+      "description": "version of detection, e.g. 1 or 2 ...",
+      "examples": [
+        "2019-12-06"
+      ],
+      "type": "string"
+    },
+    "description": {
+      "$id": "#/properties/description",
+      "default": "",
+      "description": "Description of response",
+      "examples": [
+        "Response example."
+      ],
+      "type": "string"
+    },
+    "id": {
+      "$id": "#/properties/id",
+      "default": "",
+      "description": "UUID as unique identifier",
+      "examples": [
+        "fb4c31b0-13e8-4155-8aa5-24de4b8d6717"
+      ],
+      "type": "string"
+    },
+    "name": {
+      "$id": "#/properties/name",
+      "default": "",
+      "description": "Name of response",
+      "examples": [
+        "Response Example"
+      ],
+      "type": "string"
+    },
+    "response_tasks": {
+      "$id": "#/properties/response_tasks",
+      "additionalProperties": true,
+      "default": {},
+      "description": "Response tasks divided into phases",
+      "examples": [
+        {
+          "another_phase": [
+            {
+              "id": "7c72d944-3995-4485-8e57-67b4c353989b",
+              "name": "Another investigation"
+            }
+          ],
+          "identification": [
+            {
+              "id": "c36f3f48-e0bb-4c20-a62a-cdc8f6418892",
+              "name": "Investigate Indicator of Compromise Hash"
+            },
+            {
+              "id": "0dc849b2-2eb4-4fd2-add1-b6cc475765f0",
+              "name": "Investigate Domains"
+            }
+          ]
+        }
+      ],
+      "minItems": 1,
+      "type": "array"
+    },
+    "tags": {
+      "$id": "#/properties/tags",
+      "additionalProperties": true,
+      "default": {},
+      "description": "An array of key value pairs for tagging",
+      "examples": [
+        {
+          "analytics_story": "credential_dumping"
+        }
+      ],
+      "minItems": 1,
+      "type": "object",
+      "uniqueItems": true
+    },
+    "version": {
+      "$id": "#/properties/version",
+      "default": 0,
+      "description": "version of detection, e.g. 1 or 2 ...",
+      "examples": [
+        1
+      ],
+      "type": "integer"
+    }
+  },
+  "required": [
+    "name",
+    "id",
+    "version",
+    "date",
+    "description",
+    "author",
+    "response_tasks",
+    "tags"
+  ],
+  "title": "Response Schema",
+  "type": "object"
+}

docs/spec/stories.spec.json

@@ -0,0 +1,106 @@
+{
+  "$id": "http://example.com/example.json",
+  "$schema": "http://json-schema.org/draft-07/schema",
+  "additionalProperties": true,
+  "default": {},
+  "description": "schema analytics story",
+  "properties": {
+    "author": {
+      "$id": "#/properties/author",
+      "default": "",
+      "description": "Author of the analytics story",
+      "examples": [
+        "Rico Valdez, Patrick Barei\u00df, Splunk"
+      ],
+      "type": "string"
+    },
+    "date": {
+      "$id": "#/properties/date",
+      "default": "",
+      "description": "date of creation or modification, format yyyy-mm-dd",
+      "examples": [
+        "2019-12-06"
+      ],
+      "type": "string"
+    },
+    "description": {
+      "$id": "#/properties/description",
+      "default": "",
+      "description": "description of the analytics story",
+      "examples": [
+        "Uncover activity consistent with credential dumping, a technique where attackers compromise systems and attempt to obtain and exfiltrate passwords."
+      ],
+      "type": "string"
+    },
+    "id": {
+      "$id": "#/properties/id",
+      "default": "",
+      "description": "UUID as unique identifier",
+      "examples": [
+        "fb4c31b0-13e8-4155-8aa5-24de4b8d6717"
+      ],
+      "type": "string"
+    },
+    "name": {
+      "$id": "#/properties/name",
+      "default": "",
+      "description": "Name of the Analytics Story",
+      "examples": [
+        "Credential Dumping"
+      ],
+      "type": "string"
+    },
+    "narrative": {
+      "$id": "#/properties/narrative",
+      "default": "",
+      "description": "narrative of the analytics story",
+      "examples": [
+        "gathering credentials from a target system, often hashed or encrypted, is a common attack technique. Even though the credentials may not be in plain text, an attacker can still exfiltrate the data and set to cracking it offline, on their own systems."
+      ],
+      "type": "string"
+    },
+    "search": {
+      "$id": "#/properties/search",
+      "default": "",
+      "description": "An additional Splunk search, which uses the result of the detections",
+      "examples": [
+        "index=asx mitre_id=t1003 | stats values(source) as detections values(process) as processes values(user) as users values(_time) as time count by dest"
+      ],
+      "type": "string"
+    },
+    "tags": {
+      "$id": "#/properties/tags",
+      "additionalProperties": true,
+      "default": {},
+      "description": "An explanation about the purpose of this instance.",
+      "examples": [
+        {
+          "analytics_story": "credential_dumping"
+        }
+      ],
+      "minItems": 1,
+      "type": "object"
+    },
+    "version": {
+      "$id": "#/properties/version",
+      "default": 0,
+      "description": "version of analytics story, e.g. 1 or 2 ...",
+      "examples": [
+        1
+      ],
+      "type": "integer"
+    }
+  },
+  "required": [
+    "name",
+    "id",
+    "version",
+    "date",
+    "description",
+    "narrative",
+    "author",
+    "tags"
+  ],
+  "title": "Analytics Story Schema",
+  "type": "object"
+}

docs/splunk_docs_categories.wiki

@@ -1311,6 +1311,54 @@ version = 2
 </div>
 </div>
 
+===Suspicious Zoom Child Processes===
+
+Attackers are using Zoom as an vector to increase privileges on a sytems. This story detects new child processes of zoom and provides investigative actions for this detection.
+
+<div class="toccolours mw-collapsible">
+<div class="mw-collapsible-content">
+
+====Narrative====
+Zoom is a leader in modern enterprise video communications and its usage has increased dramatically with a large amount of the population under stay-at-home orders due to the COVID-19 pandemic. With increased usage has come increased scrutiny and several security flaws have been found with this application on both Windows and macOS systems.\
+Current detections focus on finding new child processes of this application on a per host basis. Investigative searches are included to gather information needed during an investigation.
+
+====Detections====
+* Detect Prohibited Applications Spawning cmd exe
+* First Time Seen Child Process of Zoom
+
+====Data Models====
+* Endpoint
+
+====Tags====
+
+=====ATT&CK=====
+* T1059
+* T1068
+
+=====Kill Chain Phases=====
+* Actions on Objectives
+* Exploitation
+
+=====CIS=====
+* CIS 3
+* CIS 8
+
+=====NIST=====
+* DE.CM
+* PR.IP
+* PR.PT
+
+====References====
+* https://blog.rapid7.com/2020/04/02/dispelling-zoom-bugbears-what-you-need-to-know-about-the-latest-zoom-vulnerabilities/
+* https://threatpost.com/two-zoom-zero-day-flaws-uncovered/154337/
+
+date = 2020-04-13
+
+version = 1
+
+</div>
+</div>
+
 ===Windows Defense Evasion Tactics===
 
 Detect tactics used by malware to evade defenses on Windows endpoints. A few of these include suspicious `reg.exe` processes, files hidden with `attrib.exe` and disabling user-account control, among many others 
@@ -1568,7 +1616,6 @@ Monitoring user accounts within your enterprise is a critical analytic function
 * PR.IP
 
 ====References====
-* https://www.sans.org/media/critical-security-controls/critical-controls-poster-2016.pdf
 
 date = 2017-09-06
 
@@ -2195,6 +2242,8 @@ Kubernetes is the most used container orchestration platform, this orchestration
 * Amazon EKS Kubernetes Pod scan detection
 * Amazon EKS Kubernetes cluster scan detection
 * GCP Kubernetes cluster scan detection
+* Kubernetes Azure pod scan fingerprint
+* Kubernetes Azure scan fingerprint
 
 ====Data Models====
 
@@ -2219,6 +2268,82 @@ version = 1
 </div>
 </div>
 
+===Kubernetes Sensitive Object Access Activity===
+
+This story addresses detection and response of accounts acccesing Kubernetes cluster sensitive objects such as configmaps or secrets providing information on items such as user user, group. object, namespace and authorization reason.
+
+<div class="toccolours mw-collapsible">
+<div class="mw-collapsible-content">
+
+====Narrative====
+Kubernetes is the most used container orchestration platform, this orchestration platform contains sensitive objects within its architecture, specifically configmaps and secrets, if accessed by an attacker can lead to further compromise. These searches allow operator to detect suspicious requests against Kubernetes sensitive objects.
+
+====Detections====
+* Kubernetes Azure detect sensitive object access
+* Kubernetes Azure detect service accounts forbidden failure access
+* Kubernetes Azure detect suspicious kubectl calls
+
+====Data Models====
+
+====Tags====
+
+=====ATT&CK=====
+
+=====Kill Chain Phases=====
+* Lateral Movement
+
+=====CIS=====
+
+=====NIST=====
+
+====References====
+* https://www.splunk.com/en_us/blog/security/approaching-kubernetes-security-detecting-kubernetes-scan-with-splunk.html
+
+date = 2020-05-20
+
+version = 1
+
+</div>
+</div>
+
+===Kubernetes Sensitive Role Activity===
+
+This story addresses detection and response around Sensitive Role usage within a Kubernetes clusters against cluster resources and namespaces.
+
+<div class="toccolours mw-collapsible">
+<div class="mw-collapsible-content">
+
+====Narrative====
+Kubernetes is the most used container orchestration platform, this orchestration platform contains sensitive roles within its architecture, specifically configmaps and secrets, if accessed by an attacker can lead to further compromise. These searches allow operator to detect suspicious requests against Kubernetes role activities
+
+====Detections====
+* Kubernetes Azure detect RBAC authorization by account
+* Kubernetes Azure detect most active service accounts by pod namespace
+* Kubernetes Azure detect sensitive role access
+
+====Data Models====
+
+====Tags====
+
+=====ATT&CK=====
+
+=====Kill Chain Phases=====
+* Lateral Movement
+
+=====CIS=====
+
+=====NIST=====
+
+====References====
+* https://www.splunk.com/en_us/blog/security/approaching-kubernetes-security-detecting-kubernetes-scan-with-splunk.html
+
+date = 2020-05-20
+
+version = 1
+
+</div>
+</div>
+
 ===Suspicious AWS EC2 Activities===
 
 Use the searches in this Analytic Story to monitor your AWS EC2 instances for evidence of anomalous activity and suspicious behaviors, such as EC2 instances that originate from unusual locations or those launched by previously unseen users (among others). Included investigative searches will help you probe more deeply, when the information warrants it.

docs/stories_categories.md

@@ -319,6 +319,8 @@ Another search detects incidents wherein a single password is used across multip
 
 * [Suspicious WMI Use](#Suspicious-WMI-Use)
 
+* [Suspicious Zoom Child Processes](#Suspicious-Zoom-Child-Processes)
+
 * [Windows Defense Evasion Tactics](#Windows-Defense-Evasion-Tactics)
 
 * [Windows Log Manipulation](#Windows-Log-Manipulation)
@@ -1236,6 +1238,48 @@ In the event that unauthorized WMI execution occurs, it will be important for an
 * https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf
 * https://www.fireeye.com/blog/threat-research/2017/03/wmimplant_a_wmi_ba.html
 
+### Suspicious Zoom Child Processes
+* id = aa3749a6-49c7-491e-a03f-4eaee5fe0258
+* date = 2020-04-13
+* version = 1
+
+#### Description
+Attackers are using Zoom as an vector to increase privileges on a sytems. This story detects new child processes of zoom and provides investigative actions for this detection.
+
+#### Narrative
+Zoom is a leader in modern enterprise video communications and its usage has increased dramatically with a large amount of the population under stay-at-home orders due to the COVID-19 pandemic. With increased usage has come increased scrutiny and several security flaws have been found with this application on both Windows and macOS systems.\
+Current detections focus on finding new child processes of this application on a per host basis. Investigative searches are included to gather information needed during an investigation.
+
+#### Detections
+* Detect Prohibited Applications Spawning cmd exe
+* First Time Seen Child Process of Zoom
+
+#### Data Models
+* Endpoint
+
+#### Mappings
+
+##### ATT&CK
+* T1059
+* T1068
+
+##### Kill Chain Phases
+* Actions on Objectives
+* Exploitation
+
+###### CIS
+* CIS 3
+* CIS 8
+
+##### NIST
+* DE.CM
+* PR.IP
+* PR.PT
+
+##### References
+* https://blog.rapid7.com/2020/04/02/dispelling-zoom-bugbears-what-you-need-to-know-about-the-latest-zoom-vulnerabilities/
+* https://threatpost.com/two-zoom-zero-day-flaws-uncovered/154337/
+
 ### Windows Defense Evasion Tactics
 * id = 56e24a28-5003-4047-b2db-e8f3c4618064
 * date = 2018-05-31
@@ -1486,7 +1530,6 @@ Monitoring user accounts within your enterprise is a critical analytic function
 * PR.IP
 
 ##### References
-* https://www.sans.org/media/critical-security-controls/critical-controls-poster-2016.pdf
 
 ### Asset Tracking
 * id = 91c676cf-0b23-438d-abee-f6335e1fce77
@@ -1753,6 +1796,10 @@ Various legacy protocols operate by default in the clear, without the protection
 
 * [Kubernetes Scanning Activity](#Kubernetes-Scanning-Activity)
 
+* [Kubernetes Sensitive Object Access Activity](#Kubernetes-Sensitive-Object-Access-Activity)
+
+* [Kubernetes Sensitive Role Activity](#Kubernetes-Sensitive-Role-Activity)
+
 * [Suspicious AWS EC2 Activities](#Suspicious-AWS-EC2-Activities)
 
 * [Suspicious AWS Login Activities](#Suspicious-AWS-Login-Activities)
@@ -2049,6 +2096,8 @@ Kubernetes is the most used container orchestration platform, this orchestration
 * Amazon EKS Kubernetes Pod scan detection
 * Amazon EKS Kubernetes cluster scan detection
 * GCP Kubernetes cluster scan detection
+* Kubernetes Azure pod scan fingerprint
+* Kubernetes Azure scan fingerprint
 
 #### Data Models
 
@@ -2066,6 +2115,70 @@ Kubernetes is the most used container orchestration platform, this orchestration
 ##### References
 * https://github.com/splunk/cloud-datamodel-security-research
 
+### Kubernetes Sensitive Object Access Activity
+* id = 2574e6d9-7254-4751-8925-0447deeec8ea
+* date = 2020-05-20
+* version = 1
+
+#### Description
+This story addresses detection and response of accounts acccesing Kubernetes cluster sensitive objects such as configmaps or secrets providing information on items such as user user, group. object, namespace and authorization reason.
+
+#### Narrative
+Kubernetes is the most used container orchestration platform, this orchestration platform contains sensitive objects within its architecture, specifically configmaps and secrets, if accessed by an attacker can lead to further compromise. These searches allow operator to detect suspicious requests against Kubernetes sensitive objects.
+
+#### Detections
+* Kubernetes Azure detect sensitive object access
+* Kubernetes Azure detect service accounts forbidden failure access
+* Kubernetes Azure detect suspicious kubectl calls
+
+#### Data Models
+
+#### Mappings
+
+##### ATT&CK
+
+##### Kill Chain Phases
+* Lateral Movement
+
+###### CIS
+
+##### NIST
+
+##### References
+* https://www.splunk.com/en_us/blog/security/approaching-kubernetes-security-detecting-kubernetes-scan-with-splunk.html
+
+### Kubernetes Sensitive Role Activity
+* id = 2574e6d9-7254-4751-8925-0447deeec8ew
+* date = 2020-05-20
+* version = 1
+
+#### Description
+This story addresses detection and response around Sensitive Role usage within a Kubernetes clusters against cluster resources and namespaces.
+
+#### Narrative
+Kubernetes is the most used container orchestration platform, this orchestration platform contains sensitive roles within its architecture, specifically configmaps and secrets, if accessed by an attacker can lead to further compromise. These searches allow operator to detect suspicious requests against Kubernetes role activities
+
+#### Detections
+* Kubernetes Azure detect RBAC authorization by account
+* Kubernetes Azure detect most active service accounts by pod namespace
+* Kubernetes Azure detect sensitive role access
+
+#### Data Models
+
+#### Mappings
+
+##### ATT&CK
+
+##### Kill Chain Phases
+* Lateral Movement
+
+###### CIS
+
+##### NIST
+
+##### References
+* https://www.splunk.com/en_us/blog/security/approaching-kubernetes-security-detecting-kubernetes-scan-with-splunk.html
+
 ### Suspicious AWS EC2 Activities
 * id = 2e8948a5-5239-406b-b56b-6c50f1268af3
 * date = 2018-02-09

lookups/mitre_enrichment.csv

@@ -47,91 +47,98 @@ T1222,File and Directory Permissions Modification,Defense Evasion,APT32
 T1220,XSL Script Processing,Defense Evasion|Execution,Cobalt Group
 T1221,Template Injection,Defense Evasion,APT28|Tropic Trooper|Dragonfly 2.0|DarkHydrus
 T1197,BITS Jobs,Defense Evasion|Persistence,Leviathan
+T1217,Browser Bookmark Discovery,Discovery,no
 T1191,CMSTP,Defense Evasion|Execution,Cobalt Group|MuddyWater
+T1207,DCShadow,Defense Evasion,no
+T1189,Drive-by Compromise,Initial Access,Darkhotel|APT38|Lazarus Group|Dragonfly 2.0|BRONZE BUTLER|Leafminer|Threat Group-3390|APT19|Dark Caracal|APT32|Elderwood|APT37|Patchwork|PLATINUM
 T1196,Control Panel Items,Defense Evasion|Execution,no
 T1214,Credentials in Registry,Credential Access,Soft Cell
-T1207,DCShadow,Defense Evasion,no
 T1213,Data from Information Repositories,Collection,Ke3chang|APT28
-T1212,Exploitation for Credential Access,Credential Access,no
-T1217,Browser Bookmark Discovery,Discovery,no
-T1190,Exploit Public-Facing Application,Initial Access,Soft Cell|Night Dragon|Axiom
-T1210,Exploitation of Remote Services,Lateral Movement,Threat Group-3390|APT28
-T1200,Hardware Additions,Initial Access,no
-T1189,Drive-by Compromise,Initial Access,Darkhotel|APT38|Lazarus Group|Dragonfly 2.0|BRONZE BUTLER|Leafminer|APT19|Dark Caracal|Threat Group-3390|APT32|Elderwood|Patchwork|APT37|PLATINUM
 T1211,Exploitation for Defense Evasion,Defense Evasion,APT28
-T1203,Exploitation for Client Execution,Execution,APT41|admin@338|Threat Group-3390|APT12|The White Company|APT33|APT32|APT28|Tropic Trooper|BRONZE BUTLER|Lazarus Group|Cobalt Group|APT37|APT29|Patchwork|Leviathan|TA459|Elderwood
-T1208,Kerberoasting,Credential Access,no
+T1203,Exploitation for Client Execution,Execution,APT41|admin@338|Threat Group-3390|APT12|The White Company|APT33|APT32|APT28|Tropic Trooper|BRONZE BUTLER|Lazarus Group|Cobalt Group|APT37|APT29|Patchwork|TA459|Leviathan|Elderwood
+T1202,Indirect Command Execution,Defense Evasion,no
 T1215,Kernel Modules and Extensions,Persistence,no
+T1200,Hardware Additions,Initial Access,no
+T1208,Kerberoasting,Credential Access,no
+T1202,Indirect Command Execution,Defense Evasion,no
 T1201,Password Policy Discovery,Discovery,OilRig
 T1205,Port Knocking,Defense Evasion|Persistence|Command And Control,no
+T1190,Exploit Public-Facing Application,Initial Access,Soft Cell|Night Dragon|Axiom
+T1210,Exploitation of Remote Services,Lateral Movement,Threat Group-3390|APT28
+T1212,Exploitation for Credential Access,Credential Access,no
+T1200,Hardware Additions,Initial Access,no
+T1208,Kerberoasting,Credential Access,no
+T1192,Spearphishing Link,Initial Access,Machete|Kimsuky|TA505|Stolen Pencil|APT39|FIN4|APT32|Night Dragon|APT28|Cobalt Group|Turla|OilRig|Dragonfly 2.0|APT33|Elderwood|APT29|Leviathan|Magic Hound|FIN8|Patchwork
+T1206,Sudo Caching,Privilege Escalation,no
+T1199,Trusted Relationship,Initial Access,APT28|menuPass
 T1198,SIP and Trust Provider Hijacking,Defense Evasion|Persistence,no
-T1218,Signed Binary Proxy Execution,Defense Evasion|Execution,TA505|Rancor|Cobalt Group
-T1202,Indirect Command Execution,Defense Evasion,no
 T1194,Spearphishing via Service,Initial Access,FIN6|OilRig|Dark Caracal|Magic Hound
+T1192,Spearphishing Link,Initial Access,Machete|Kimsuky|TA505|Stolen Pencil|APT39|FIN4|APT32|Night Dragon|APT28|Turla|Cobalt Group|Dragonfly 2.0|OilRig|APT33|Elderwood|Patchwork|APT29|Leviathan|Magic Hound|FIN8
 T1195,Supply Chain Compromise,Initial Access,APT41|Elderwood
 T1219,Remote Access Tools,Command And Control,Kimsuky|Night Dragon|Thrip|Cobalt Group|Carbanak
 T1216,Signed Script Proxy Execution,Defense Evasion|Execution,APT32
-T1193,Spearphishing Attachment,Initial Access,APT41|Machete|admin@338|Kimsuky|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|Tropic Trooper|Turla|Gorgon Group|Rancor|DarkHydrus|Lazarus Group|Cobalt Group|OilRig|APT19|FIN7|BRONZE BUTLER|Dragonfly 2.0|APT32|FIN8|MuddyWater|APT28|TA459|Elderwood|APT29|APT37|Patchwork|Leviathan|menuPass|Magic Hound|PLATINUM
+T1193,Spearphishing Attachment,Initial Access,APT41|Machete|admin@338|Kimsuky|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|Tropic Trooper|Turla|Rancor|Gorgon Group|DarkHydrus|Lazarus Group|Cobalt Group|FIN7|APT19|BRONZE BUTLER|OilRig|Dragonfly 2.0|APT32|MuddyWater|FIN8|APT28|TA459|Patchwork|Elderwood|APT29|APT37|Leviathan|Magic Hound|menuPass|PLATINUM
+T1218,Signed Binary Proxy Execution,Defense Evasion|Execution,TA505|Rancor|Cobalt Group
 T1209,Time Providers,Persistence,no
-T1204,User Execution,Execution,Machete|admin@338|APT12|TA505|Silence|The White Company|APT39|FIN4|Night Dragon|Darkhotel|Gallmaker|Dragonfly 2.0|APT33|APT19|BRONZE BUTLER|Dark Caracal|Cobalt Group|FIN7|DarkHydrus|Turla|Gorgon Group|OilRig|MuddyWater|Patchwork|Lazarus Group|APT32|Rancor|APT37|APT28|APT29|menuPass|FIN8|TA459|Elderwood|Leviathan|Magic Hound|PLATINUM
-T1192,Spearphishing Link,Initial Access,Machete|Kimsuky|TA505|Stolen Pencil|APT39|FIN4|APT32|Night Dragon|APT28|Turla|Cobalt Group|Dragonfly 2.0|OilRig|APT33|Elderwood|APT29|Leviathan|Patchwork|Magic Hound|FIN8
-T1206,Sudo Caching,Privilege Escalation,no
-T1199,Trusted Relationship,Initial Access,APT28|menuPass
+T1204,User Execution,Execution,Machete|admin@338|APT12|TA505|Silence|The White Company|APT39|FIN4|Night Dragon|Darkhotel|Gallmaker|APT33|APT19|BRONZE BUTLER|Dragonfly 2.0|Dark Caracal|DarkHydrus|Cobalt Group|FIN7|Turla|Lazarus Group|APT32|Gorgon Group|OilRig|MuddyWater|Patchwork|Rancor|APT28|FIN8|APT37|APT29|menuPass|TA459|Elderwood|Leviathan|Magic Hound|PLATINUM
 T1182,AppCert DLLs,Persistence|Privilege Escalation,Honeybee
-T1176,Browser Extensions,Persistence,Kimsuky|Stolen Pencil
 T1175,Component Object Model and Distributed COM,Lateral Movement|Execution,MuddyWater
-T1181,Extra Window Memory Injection,Defense Evasion|Privilege Escalation,no
-T1179,Hooking,Persistence|Privilege Escalation|Credential Access,PLATINUM
+T1176,Browser Extensions,Persistence,Kimsuky|Stolen Pencil
 T1172,Domain Fronting,Command And Control,APT29
-T1187,Forced Authentication,Credential Access,DarkHydrus|Dragonfly 2.0
 T1173,Dynamic Data Exchange,Execution,TA505|MuddyWater|Gallmaker|Patchwork|Cobalt Group|APT37|APT28|FIN7
-T1188,Multi-hop Proxy,Command And Control,FIN4|APT29
-T1171,LLMNR/NBT-NS Poisoning and Relay,Credential Access,no
-T1177,LSASS Driver,Execution|Persistence,no
-T1174,Password Filter DLL,Credential Access,no
-T1180,Screensaver,Persistence,no
+T1179,Hooking,Persistence|Privilege Escalation|Credential Access,PLATINUM
 T1183,Image File Execution Options Injection,Privilege Escalation|Persistence|Defense Evasion,TEMP.Veles
-T1170,Mshta,Defense Evasion|Execution,Kimsuky|APT32|MuddyWater|FIN7
-T1184,SSH Hijacking,Lateral Movement,no
+T1177,LSASS Driver,Execution|Persistence,no
 T1185,Man in the Browser,Collection,no
+T1181,Extra Window Memory Injection,Defense Evasion|Privilege Escalation,no
+T1188,Multi-hop Proxy,Command And Control,FIN4|APT29
+T1187,Forced Authentication,Credential Access,DarkHydrus|Dragonfly 2.0
+T1170,Mshta,Defense Evasion|Execution,Kimsuky|APT32|MuddyWater|FIN7
 T1186,Process Doppelgänging,Defense Evasion,no
+T1171,LLMNR/NBT-NS Poisoning and Relay,Credential Access,no
+T1174,Password Filter DLL,Credential Access,no
 T1178,SID-History Injection,Privilege Escalation,no
+T1180,Screensaver,Persistence,no
+T1184,SSH Hijacking,Lateral Movement,no
 T1156,.bash_profile and .bashrc,Persistence,no
 T1134,Access Token Manipulation,Defense Evasion|Privilege Escalation,Turla|Lazarus Group|APT28
 T1155,AppleScript,Execution|Lateral Movement,no
 T1138,Application Shimming,Persistence|Privilege Escalation,FIN7
 T1139,Bash History,Credential Access,no
-T1146,Clear Command History,Defense Evasion,APT41
 T1136,Create Account,Persistence,APT41|Soft Cell|Dragonfly 2.0|Leafminer|APT3
-T1140,Deobfuscate/Decode Files or Information,Defense Evasion,Turla|WIRTE|Darkhotel|Tropic Trooper|Gorgon Group|Honeybee|menuPass|Threat Group-3390|APT19|Leviathan|MuddyWater|APT28|OilRig|BRONZE BUTLER
 T1157,Dylib Hijacking,Persistence|Privilege Escalation,no
-T1148,HISTCONTROL,Defense Evasion,no
-T1147,Hidden Users,Defense Evasion,no
-T1143,Hidden Window,Defense Evasion,Gorgon Group|Deep Panda|DarkHydrus|CopyKittens|APT19|APT32|APT28|APT3|Magic Hound
+T1146,Clear Command History,Defense Evasion,APT41
+T1140,Deobfuscate/Decode Files or Information,Defense Evasion,Turla|WIRTE|Darkhotel|Tropic Trooper|menuPass|Honeybee|Gorgon Group|Threat Group-3390|APT19|Leviathan|MuddyWater|APT28|OilRig|BRONZE BUTLER
 T1144,Gatekeeper Bypass,Defense Evasion,no
+T1148,HISTCONTROL,Defense Evasion,no
 T1158,Hidden Files and Directories,Defense Evasion|Persistence,APT32|Tropic Trooper|APT28|Lazarus Group
-T1149,LC_MAIN Hijacking,Defense Evasion,no
-T1152,Launchctl,Defense Evasion|Execution|Persistence,no
-T1168,Local Job Scheduling,Persistence|Execution,no
 T1141,Input Prompt,Credential Access,FIN4
-T1162,Login Item,Persistence,no
-T1137,Office Application Startup,Persistence,APT32|APT28
-T1150,Plist Modification,Defense Evasion|Persistence|Privilege Escalation,no
-T1145,Private Keys,Credential Access,no
-T1163,Rc.common,Persistence,no
-T1142,Keychain,Credential Access,no
-T1159,Launch Agent,Persistence,no
-T1151,Space after Filename,Defense Evasion|Execution,no
 T1161,LC_LOAD_DYLIB Addition,Persistence,no
 T1160,Launch Daemon,Persistence|Privilege Escalation,no
-T1153,Source,Execution,no
-T1154,Trap,Execution|Persistence,no
+T1162,Login Item,Persistence,no
+T1137,Office Application Startup,Persistence,APT32|APT28
+T1163,Rc.common,Persistence,no
+T1147,Hidden Users,Defense Evasion,no
+T1149,LC_MAIN Hijacking,Defense Evasion,no
+T1152,Launchctl,Defense Evasion|Execution|Persistence,no
+T1142,Keychain,Credential Access,no
+T1159,Launch Agent,Persistence,no
 T1135,Network Share Discovery,Discovery,APT41|Tropic Trooper|APT1|Dragonfly 2.0|Sowbug
 T1164,Re-opened Applications,Persistence,no
-T1169,Sudo,Privilege Escalation,no
+T1143,Hidden Window,Defense Evasion,Gorgon Group|Deep Panda|DarkHydrus|CopyKittens|APT19|APT32|APT28|APT3|Magic Hound
+T1168,Local Job Scheduling,Persistence|Execution,no
+T1150,Plist Modification,Defense Evasion|Persistence|Privilege Escalation,no
+T1145,Private Keys,Credential Access,no
 T1167,Securityd Memory,Credential Access,no
 T1166,Setuid and Setgid,Privilege Escalation|Persistence,no
+T1153,Source,Execution,no
+T1164,Re-opened Applications,Persistence,no
+T1154,Trap,Execution|Persistence,no
 T1165,Startup Items,Persistence|Privilege Escalation,no
+T1169,Sudo,Privilege Escalation,no
+T1153,Source,Execution,no
+T1151,Space after Filename,Defense Evasion|Execution,no
+T1154,Trap,Execution|Persistence,no
 T1133,External Remote Services,Persistence|Initial Access,APT41|Soft Cell|TEMP.Veles|Night Dragon|OilRig|Ke3chang|Dragonfly 2.0|FIN5|Threat Group-3390|APT18
 T1132,Data Encoding,Command And Control,APT33|APT19|Lazarus Group|BRONZE BUTLER|Patchwork
 T1131,Authentication Package,Persistence,no
@@ -148,19 +155,19 @@ T1121,Regsvcs/Regasm,Defense Evasion|Execution,no
 T1120,Peripheral Device Discovery,Discovery,APT37|Gamaredon Group|Equation|APT28
 T1119,Automated Collection,Collection,APT1|APT28|Patchwork|OilRig|FIN5|Threat Group-3390|FIN6
 T1118,InstallUtil,Defense Evasion|Execution,no
-T1117,Regsvr32,Defense Evasion|Execution,WIRTE|APT19|Cobalt Group|Leviathan|APT32|Deep Panda
+T1117,Regsvr32,Defense Evasion|Execution,WIRTE|Cobalt Group|APT19|Leviathan|APT32|Deep Panda
 T1116,Code Signing,Defense Evasion,APT41|FIN6|TA505|FIN7|Honeybee|APT37|Leviathan|CopyKittens|Winnti Group|Suckfly|Molerats|Darkhotel
 T1115,Clipboard Data,Collection,APT38
-T1114,Email Collection,Collection,FIN4|Dragonfly 2.0|APT28|Magic Hound|Ke3chang|Leafminer|APT1
+T1114,Email Collection,Collection,FIN4|APT28|Magic Hound|Ke3chang|Dragonfly 2.0|Leafminer|APT1
 T1113,Screen Capture,Collection,Silence|MuddyWater|OilRig|Dragonfly 2.0|Dark Caracal|FIN7|BRONZE BUTLER|Magic Hound|Group5|APT28
-T1112,Modify Registry,Defense Evasion,APT41|Turla|APT32|APT38|Dragonfly 2.0|Threat Group-3390|Patchwork|APT19|Honeybee|Gorgon Group|FIN8
+T1112,Modify Registry,Defense Evasion,APT41|Turla|APT32|APT38|Dragonfly 2.0|Patchwork|APT19|Threat Group-3390|Honeybee|Gorgon Group|FIN8
 T1111,Two-Factor Authentication Interception,Credential Access,no
 T1110,Brute Force,Credential Access,APT41|APT33|Leafminer|OilRig|Dragonfly 2.0|APT3|Lazarus Group|Turla
 T1109,Component Firmware,Defense Evasion|Persistence,Equation
 T1108,Redundant Access,Defense Evasion|Persistence,Stolen Pencil|Cobalt Group|Leafminer|APT3|FIN5|OilRig|Threat Group-3390
-T1107,File Deletion,Defense Evasion,APT41|Kimsuky|Silence|The White Company|TEMP.Veles|APT32|APT38|Honeybee|Patchwork|Dragonfly 2.0|menuPass|Cobalt Group|FIN8|OilRig|FIN5|BRONZE BUTLER|Magic Hound|APT3|FIN10|Threat Group-3390|APT28|Group5|Lazarus Group|APT18|APT29
+T1107,File Deletion,Defense Evasion,APT41|Kimsuky|Silence|The White Company|TEMP.Veles|APT32|APT38|Honeybee|Patchwork|menuPass|Cobalt Group|Dragonfly 2.0|FIN8|OilRig|FIN5|Magic Hound|BRONZE BUTLER|APT3|FIN10|APT28|Threat Group-3390|Group5|Lazarus Group|APT18|APT29
 T1106,Execution through API,Execution,Turla|Silence|APT37|Gorgon Group
-T1105,Remote File Copy,Command And Control|Lateral Movement,Soft Cell|TA505|WIRTE|APT33|MuddyWater|APT18|APT38|Turla|Rancor|Gorgon Group|Cobalt Group|Dragonfly 2.0|OilRig|APT37|FIN8|PLATINUM|Leviathan|Elderwood|Magic Hound|APT3|APT32|BRONZE BUTLER|FIN7|FIN10|menuPass|Gamaredon Group|Patchwork|Lazarus Group|Threat Group-3390|APT28
+T1105,Remote File Copy,Command And Control|Lateral Movement,Soft Cell|TA505|WIRTE|APT33|MuddyWater|APT18|APT38|Gorgon Group|Cobalt Group|Rancor|Turla|Dragonfly 2.0|OilRig|APT37|FIN8|PLATINUM|Leviathan|Elderwood|APT3|Magic Hound|APT32|BRONZE BUTLER|FIN7|FIN10|menuPass|Gamaredon Group|Patchwork|Lazarus Group|Threat Group-3390|APT28
 T1104,Multi-Stage Channels,Command And Control,MuddyWater|APT3
 T1103,AppInit DLLs,Persistence|Privilege Escalation,no
 T1102,Web Service,Command And Control|Defense Evasion,APT41|APT12|FIN6|Turla|FIN7|BRONZE BUTLER|Leviathan|APT37|Magic Hound|RTM|Patchwork|Carbanak
@@ -179,43 +186,43 @@ T1090,Connection Proxy,Command And Control|Defense Evasion,APT41|Soft Cell|Turla
 T1089,Disabling Security Tools,Defense Evasion,Kimsuky|Turla|Night Dragon|Dragonfly 2.0|Gorgon Group|Threat Group-3390|Lazarus Group|Putter Panda|Carbanak
 T1088,Bypass User Account Control,Defense Evasion|Privilege Escalation,APT37|MuddyWater|Honeybee|Threat Group-3390|Cobalt Group|BRONZE BUTLER|Patchwork|APT29
 T1087,Account Discovery,Discovery,APT32|APT1|Dragonfly 2.0|BRONZE BUTLER|OilRig|Threat Group-3390|menuPass|FIN6|Poseidon Group|APT3|admin@338|Ke3chang
-T1086,PowerShell,Execution,APT41|Kimsuky|Soft Cell|TA505|WIRTE|TEMP.Veles|APT33|Gallmaker|Turla|DarkHydrus|APT19|APT28|Thrip|Dragonfly 2.0|Cobalt Group|Gorgon Group|Leviathan|TA459|MuddyWater|FIN8|CopyKittens|OilRig|Magic Hound|BRONZE BUTLER|APT32|FIN10|FIN7|Threat Group-3390|menuPass|Patchwork|Stealth Falcon|FIN6|Poseidon Group|APT3|APT29|Deep Panda
+T1086,PowerShell,Execution,APT41|Kimsuky|Soft Cell|TA505|WIRTE|TEMP.Veles|APT33|Gallmaker|Turla|Dragonfly 2.0|APT19|Thrip|DarkHydrus|APT28|Cobalt Group|Gorgon Group|Leviathan|TA459|MuddyWater|FIN8|CopyKittens|OilRig|BRONZE BUTLER|Magic Hound|APT32|FIN10|FIN7|Threat Group-3390|menuPass|Patchwork|Stealth Falcon|FIN6|Poseidon Group|APT3|APT29|Deep Panda
 T1085,Rundll32,Defense Evasion|Execution,TA505|MuddyWater|APT29|APT19|CopyKittens|APT3|Carbanak|APT28
 T1084,Windows Management Instrumentation Event Subscription,Persistence,Turla|Leviathan|APT29
-T1083,File and Directory Discovery,Discovery,Kimsuky|APT32|MuddyWater|APT18|Leafminer|Dragonfly 2.0|Honeybee|Dark Caracal|Magic Hound|APT3|Sowbug|BRONZE BUTLER|APT28|Patchwork|Lazarus Group|Dust Storm|admin@338|Turla|Ke3chang
-T1082,System Information Discovery,Discovery,Kimsuky|Tropic Trooper|Darkhotel|MuddyWater|APT18|APT37|Honeybee|APT19|APT32|Magic Hound|OilRig|APT3|Sowbug|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|admin@338|Turla|Ke3chang
+T1083,File and Directory Discovery,Discovery,Kimsuky|APT32|MuddyWater|APT18|Dragonfly 2.0|Dark Caracal|Leafminer|Honeybee|Magic Hound|BRONZE BUTLER|APT3|Sowbug|APT28|Patchwork|Lazarus Group|Dust Storm|admin@338|Turla|Ke3chang
+T1082,System Information Discovery,Discovery,Kimsuky|Tropic Trooper|Darkhotel|MuddyWater|APT18|APT37|Honeybee|APT19|APT32|APT3|OilRig|Magic Hound|Sowbug|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|admin@338|Turla|Ke3chang
 T1081,Credentials in Files,Credential Access,OilRig|Kimsuky|Turla|TA505|Stolen Pencil|MuddyWater|APT3
 T1080,Taint Shared Content,Lateral Movement,Darkhotel
 T1079,Multilayer Encryption,Command And Control,no
-T1078,Valid Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,APT41|Soft Cell|TEMP.Veles|APT39|Stolen Pencil|FIN4|Night Dragon|Dragonfly 2.0|FIN8|Leviathan|APT33|APT3|FIN5|OilRig|menuPass|APT28|FIN10|APT32|Suckfly|FIN6|Threat Group-1314|Threat Group-3390|APT18|PittyTiger|Carbanak
+T1078,Valid Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,APT41|Soft Cell|TEMP.Veles|APT39|Stolen Pencil|FIN4|Night Dragon|Dragonfly 2.0|FIN8|APT33|Leviathan|APT3|FIN5|OilRig|menuPass|APT28|FIN10|APT32|Suckfly|FIN6|Threat Group-1314|Threat Group-3390|APT18|PittyTiger|Carbanak
 T1077,Windows Admin Shares,Lateral Movement,APT32|Orangeworm|FIN8|APT3|Lazarus Group|Threat Group-1314|Turla|Deep Panda|Ke3chang
 T1076,Remote Desktop Protocol,Lateral Movement,APT41|TEMP.Veles|Leviathan|APT39|Stolen Pencil|Cobalt Group|Dragonfly 2.0|FIN8|APT3|OilRig|menuPass|FIN10|Patchwork|FIN6|Lazarus Group|APT1|Axiom
 T1075,Pass the Hash,Lateral Movement,Soft Cell|APT32|Night Dragon|APT28|APT1
-T1074,Data Staged,Collection,Machete|Soft Cell|TEMP.Veles|Night Dragon|Honeybee|Patchwork|Dragonfly 2.0|Leviathan|FIN8|APT3|FIN5|menuPass|FIN6|Lazarus Group|Threat Group-3390|APT28
+T1074,Data Staged,Collection,Machete|Soft Cell|TEMP.Veles|Night Dragon|Patchwork|Honeybee|Dragonfly 2.0|Leviathan|FIN8|APT3|FIN5|menuPass|FIN6|Lazarus Group|Threat Group-3390|APT28
 T1073,DLL Side-Loading,Defense Evasion,APT41|Soft Cell|Tropic Trooper|Patchwork|APT19|APT32|APT3|menuPass|Threat Group-3390
 T1072,Third-party Software,Execution|Lateral Movement,Threat Group-1314
-T1071,Standard Application Layer Protocol,Command And Control,APT41|Machete|WIRTE|APT33|FIN4|Night Dragon|APT18|SilverTerrier|APT38|Dragonfly 2.0|APT19|Cobalt Group|FIN7|Threat Group-3390|Turla|APT37|Rancor|Orangeworm|Honeybee|Ke3chang|Dark Caracal|Lazarus Group|BRONZE BUTLER|APT32|OilRig|Magic Hound|Gamaredon Group|Stealth Falcon|FIN6|APT28
+T1071,Standard Application Layer Protocol,Command And Control,APT41|Machete|WIRTE|APT33|FIN4|Night Dragon|APT18|SilverTerrier|APT38|APT19|Dragonfly 2.0|Cobalt Group|Threat Group-3390|FIN7|Turla|Honeybee|APT37|Rancor|Orangeworm|Ke3chang|Dark Caracal|Lazarus Group|BRONZE BUTLER|Magic Hound|OilRig|APT32|Gamaredon Group|Stealth Falcon|FIN6|APT28
 T1070,Indicator Removal on Host,Defense Evasion,APT41|APT29|APT38|Dragonfly 2.0|APT32|FIN8|FIN5|APT28
 T1069,Permission Groups Discovery,Discovery,FIN6|Dragonfly 2.0|OilRig|APT3|admin@338|Ke3chang
 T1068,Exploitation for Privilege Escalation,Privilege Escalation,APT33|Cobalt Group|PLATINUM|FIN8|APT32|Threat Group-3390|FIN6|APT28
 T1067,Bootkit,Persistence,APT41|Lazarus Group|APT28
 T1066,Indicator Removal from Tools,Defense Evasion,Soft Cell|TEMP.Veles|Patchwork|APT3|Turla|OilRig|Deep Panda
 T1065,Uncommonly Used Port,Command And Control,TEMP.Veles|APT33|APT32|Gorgon Group|Magic Hound|Group5|Lazarus Group|APT3
-T1064,Scripting,Defense Evasion|Execution,Machete|Turla|TA505|Silence|WIRTE|APT39|FIN4|APT32|Darkhotel|Gallmaker|Dark Caracal|Lazarus Group|menuPass|APT19|Dragonfly 2.0|Leafminer|Rancor|Honeybee|APT37|Ke3chang|Cobalt Group|Patchwork|FIN7|Gorgon Group|MuddyWater|Leviathan|FIN8|TA459|APT28|Magic Hound|OilRig|FIN5|BRONZE BUTLER|FIN10|Gamaredon Group|Stealth Falcon|FIN6|APT3|APT29|Deep Panda|APT1
+T1064,Scripting,Defense Evasion|Execution,Machete|Turla|TA505|Silence|WIRTE|APT39|FIN4|APT32|Darkhotel|Gallmaker|Dark Caracal|Lazarus Group|menuPass|Leafminer|Rancor|Cobalt Group|APT19|Dragonfly 2.0|Honeybee|Ke3chang|Patchwork|FIN7|APT37|Gorgon Group|MuddyWater|Leviathan|TA459|FIN8|APT28|Magic Hound|OilRig|BRONZE BUTLER|FIN5|FIN10|Gamaredon Group|Stealth Falcon|FIN6|APT3|APT29|Deep Panda|APT1
 T1063,Security Software Discovery,Discovery,The White Company|Cobalt Group|Darkhotel|MuddyWater|Tropic Trooper|FIN8|Patchwork|Naikon
 T1062,Hypervisor,Persistence,no
 T1061,Graphical User Interface,Execution,APT3
-T1060,Registry Run Keys / Startup Folder,Persistence,APT41|Machete|Kimsuky|APT33|APT39|APT32|APT18|Turla|APT19|Dark Caracal|Ke3chang|Dragonfly 2.0|Cobalt Group|Honeybee|Threat Group-3390|Gorgon Group|MuddyWater|APT37|Leviathan|BRONZE BUTLER|APT3|Magic Hound|FIN10|FIN7|Patchwork|FIN6|Lazarus Group|Putter Panda|APT29|Darkhotel
-T1059,Command-Line Interface,Execution,APT41|Soft Cell|Turla|Silence|APT32|Cobalt Group|MuddyWater|APT18|APT38|Dragonfly 2.0|Gorgon Group|APT28|FIN7|Rancor|Honeybee|APT37|Leviathan|FIN8|Magic Hound|Sowbug|OilRig|BRONZE BUTLER|menuPass|Threat Group-3390|Suckfly|Patchwork|Lazarus Group|Threat Group-1314|APT3|admin@338|APT1|Ke3chang
+T1060,Registry Run Keys / Startup Folder,Persistence,APT41|Machete|Kimsuky|APT33|APT39|APT32|APT18|Turla|Threat Group-3390|APT19|Cobalt Group|Honeybee|Dark Caracal|Ke3chang|Dragonfly 2.0|Gorgon Group|MuddyWater|APT37|Leviathan|APT3|BRONZE BUTLER|Magic Hound|FIN10|FIN7|Patchwork|FIN6|Lazarus Group|Putter Panda|APT29|Darkhotel
+T1059,Command-Line Interface,Execution,APT41|Soft Cell|Turla|Silence|APT32|Cobalt Group|MuddyWater|APT18|APT38|Dragonfly 2.0|APT28|Gorgon Group|Honeybee|FIN7|Rancor|APT37|Leviathan|FIN8|Magic Hound|BRONZE BUTLER|Sowbug|OilRig|menuPass|Threat Group-3390|Suckfly|Patchwork|Lazarus Group|Threat Group-1314|APT3|admin@338|APT1|Ke3chang
 T1058,Service Registry Permissions Weakness,Persistence|Privilege Escalation,no
 T1057,Process Discovery,Discovery,Darkhotel|MuddyWater|APT1|APT38|Tropic Trooper|APT37|Honeybee|OilRig|APT3|Magic Hound|APT28|Winnti Group|Stealth Falcon|Poseidon Group|Lazarus Group|Molerats|Turla|Deep Panda|Ke3chang
-T1056,Input Capture,Collection|Credential Access,APT41|Kimsuky|menuPass|Stolen Pencil|FIN4|APT38|OilRig|Ke3chang|PLATINUM|Sowbug|Magic Hound|Group5|Lazarus Group|Threat Group-3390|APT3|Darkhotel|APT28
-T1055,Process Injection,Defense Evasion|Privilege Escalation,APT41|Kimsuky|Tropic Trooper|Gorgon Group|Turla|Threat Group-3390|APT37|Cobalt Group|Honeybee|Lazarus Group|PLATINUM|Putter Panda
+T1056,Input Capture,Collection|Credential Access,APT41|Kimsuky|menuPass|Stolen Pencil|FIN4|APT38|OilRig|Ke3chang|PLATINUM|Magic Hound|Sowbug|Group5|Lazarus Group|Threat Group-3390|APT3|Darkhotel|APT28
+T1055,Process Injection,Defense Evasion|Privilege Escalation,APT41|Kimsuky|Tropic Trooper|Threat Group-3390|APT37|Gorgon Group|Turla|Cobalt Group|Honeybee|Lazarus Group|PLATINUM|Putter Panda
 T1054,Indicator Blocking,Defense Evasion,no
-T1053,Scheduled Task,Execution|Persistence|Privilege Escalation,APT41|Machete|Soft Cell|Silence|TEMP.Veles|APT33|APT39|Cobalt Group|Dragonfly 2.0|OilRig|Rancor|Patchwork|FIN8|BRONZE BUTLER|menuPass|FIN10|APT32|FIN7|Stealth Falcon|FIN6|Threat Group-3390|APT18|APT3|APT29
+T1053,Scheduled Task,Execution|Persistence|Privilege Escalation,APT41|Machete|Soft Cell|Silence|TEMP.Veles|APT33|APT39|Cobalt Group|Dragonfly 2.0|Patchwork|OilRig|Rancor|FIN8|BRONZE BUTLER|menuPass|FIN10|APT32|FIN7|Stealth Falcon|FIN6|Threat Group-3390|APT18|APT3|APT29
 T1052,Exfiltration Over Physical Medium,Exfiltration,no
 T1051,Shared Webroot,Lateral Movement,no
-T1050,New Service,Persistence|Privilege Escalation,Kimsuky|Tropic Trooper|Cobalt Group|Ke3chang|FIN7|APT32|Threat Group-3390|APT3|Lazarus Group|Carbanak
+T1050,New Service,Persistence|Privilege Escalation,Kimsuky|Tropic Trooper|Cobalt Group|Threat Group-3390|Ke3chang|FIN7|APT32|APT3|Lazarus Group|Carbanak
 T1049,System Network Connections Discovery,Discovery,APT41|APT38|Soft Cell|APT32|APT1|OilRig|APT3|menuPass|Threat Group-3390|Poseidon Group|admin@338|Turla|Ke3chang
 T1048,Exfiltration Over Alternative Protocol,Exfiltration,Turla|APT33|Thrip|FIN8|OilRig|Lazarus Group
 T1047,Windows Management Instrumentation,Execution,APT41|FIN6|Soft Cell|APT32|MuddyWater|OilRig|Threat Group-3390|Leviathan|FIN8|menuPass|Stealth Falcon|Lazarus Group|APT29|Deep Panda
@@ -238,16 +245,16 @@ T1031,Modify Existing Service,Persistence,APT41|APT32|Honeybee|APT19
 T1030,Data Transfer Size Limits,Exfiltration,Threat Group-3390
 T1029,Scheduled Transfer,Exfiltration,no
 T1028,Windows Remote Management,Execution|Lateral Movement,Threat Group-3390
-T1027,Obfuscated Files or Information,Defense Evasion,Machete|Soft Cell|Turla|TA505|Silence|APT33|Night Dragon|Darkhotel|Gallmaker|APT29|APT18|Tropic Trooper|menuPass|Patchwork|Leafminer|Cobalt Group|APT37|Threat Group-3390|Honeybee|Dark Caracal|APT19|FIN8|BlackOasis|Elderwood|Leviathan|MuddyWater|FIN7|Magic Hound|APT3|OilRig|APT32|Group5|Dust Storm|Lazarus Group|Putter Panda|APT28
+T1027,Obfuscated Files or Information,Defense Evasion,Machete|Soft Cell|Turla|TA505|Silence|APT33|Night Dragon|Darkhotel|Gallmaker|APT29|APT18|Tropic Trooper|menuPass|Patchwork|Leafminer|Honeybee|Cobalt Group|APT37|Threat Group-3390|Dark Caracal|APT19|FIN8|BlackOasis|Leviathan|Elderwood|FIN7|MuddyWater|Magic Hound|APT3|OilRig|APT32|Group5|Dust Storm|Lazarus Group|Putter Panda|APT28
 T1026,Multiband Communication,Command And Control,Lazarus Group
 T1025,Data from Removable Media,Collection,Machete|Turla|Gamaredon Group|APT28
 T1024,Custom Cryptographic Protocol,Command And Control,APT28|BRONZE BUTLER|Lazarus Group
-T1023,Shortcut Modification,Persistence,APT39|Darkhotel|APT29|FIN7|Gorgon Group|Dragonfly 2.0|Leviathan|Lazarus Group
+T1023,Shortcut Modification,Persistence,APT39|Darkhotel|APT29|Gorgon Group|FIN7|Dragonfly 2.0|Leviathan|Lazarus Group
 T1022,Data Encrypted,Exfiltration,Kimsuky|Soft Cell|Turla|menuPass|APT32|Patchwork|Honeybee|CopyKittens|BRONZE BUTLER|FIN6|Lazarus Group|Threat Group-3390|Ke3chang
 T1021,Remote Services,Lateral Movement,TEMP.Veles|Leviathan|APT39|OilRig|menuPass|GCMAN
 T1020,Automated Exfiltration,Exfiltration,Honeybee
 T1019,System Firmware,Persistence,no
-T1018,Remote System Discovery,Discovery,Soft Cell|APT32|Threat Group-3390|Dragonfly 2.0|Deep Panda|Ke3chang|Leafminer|FIN8|APT3|FIN5|BRONZE BUTLER|menuPass|FIN6|Turla
+T1018,Remote System Discovery,Discovery,Soft Cell|APT32|Threat Group-3390|Dragonfly 2.0|Deep Panda|Ke3chang|Leafminer|FIN8|FIN5|APT3|BRONZE BUTLER|menuPass|FIN6|Turla
 T1017,Application Deployment Software,Lateral Movement,APT32
 T1016,System Network Configuration Discovery,Discovery,APT41|Soft Cell|APT39|APT32|Darkhotel|MuddyWater|APT1|APT19|Dragonfly 2.0|OilRig|Magic Hound|menuPass|Threat Group-3390|Stealth Falcon|Lazarus Group|APT3|Naikon|admin@338|Turla|Ke3chang
 T1015,Accessibility Features,Persistence|Privilege Escalation,APT41|APT3|APT29|Deep Panda|Axiom
@@ -260,8 +267,8 @@ T1009,Binary Padding,Defense Evasion,Patchwork|APT32|Leviathan|BRONZE BUTLER|Moa
 T1008,Fallback Channels,Command And Control,APT41|OilRig|Lazarus Group
 T1007,System Service Discovery,Discovery,APT1|OilRig|Poseidon Group|admin@338|Turla|Ke3chang
 T1006,File System Logical Offsets,Defense Evasion,no
-T1005,Data from Local System,Collection,Kimsuky|Soft Cell|Turla|menuPass|Dragonfly 2.0|Dark Caracal|Honeybee|APT37|APT28|APT3|BRONZE BUTLER|Patchwork|Stealth Falcon|Lazarus Group|Dust Storm|Threat Group-3390|APT1|Ke3chang
+T1005,Data from Local System,Collection,Kimsuky|Soft Cell|Turla|menuPass|Dark Caracal|Dragonfly 2.0|Honeybee|APT37|APT28|APT3|BRONZE BUTLER|Patchwork|Stealth Falcon|Lazarus Group|Dust Storm|Threat Group-3390|APT1|Ke3chang
 T1004,Winlogon Helper DLL,Persistence,Tropic Trooper|Turla
-T1003,Credential Dumping,Credential Access,APT41|Soft Cell|TEMP.Veles|APT33|Leviathan|APT39|Stolen Pencil|APT32|Night Dragon|Dragonfly 2.0|Leafminer|Lazarus Group|Magic Hound|APT37|MuddyWater|PLATINUM|FIN8|Sowbug|BRONZE BUTLER|FIN5|OilRig|menuPass|Strider|Patchwork|Stealth Falcon|Suckfly|FIN6|Poseidon Group|Threat Group-3390|APT3|Molerats|APT28|APT1|Ke3chang|Cleaver|Axiom
-T1002,Data Compressed,Exfiltration,APT41|Soft Cell|Gallmaker|APT33|APT32|APT39|MuddyWater|Honeybee|Magic Hound|APT28|Dragonfly 2.0|FIN8|BRONZE BUTLER|CopyKittens|Sowbug|APT3|menuPass|FIN6|Lazarus Group|Threat Group-3390|APT1|Ke3chang
+T1003,Credential Dumping,Credential Access,APT41|Soft Cell|TEMP.Veles|APT33|Leviathan|APT39|Stolen Pencil|APT32|Night Dragon|Dragonfly 2.0|Leafminer|Lazarus Group|Magic Hound|APT37|PLATINUM|MuddyWater|FIN8|Sowbug|BRONZE BUTLER|OilRig|FIN5|menuPass|Strider|Patchwork|Stealth Falcon|Suckfly|FIN6|Poseidon Group|Threat Group-3390|APT3|Molerats|APT28|APT1|Ke3chang|Cleaver|Axiom
+T1002,Data Compressed,Exfiltration,APT41|Soft Cell|Gallmaker|APT33|APT32|APT39|MuddyWater|Honeybee|APT28|Magic Hound|Dragonfly 2.0|FIN8|BRONZE BUTLER|CopyKittens|Sowbug|APT3|menuPass|FIN6|Lazarus Group|Threat Group-3390|APT1|Ke3chang
 T1001,Data Obfuscation,Command And Control,APT28|Axiom

lookups/prohibited_apps_launching_cmd.csv

@@ -14,3 +14,4 @@ firefox.exe,prohibited
 java.exe,prohibited
 powershell.exe,prohibited
 mshta.exe, prohibited
+zoom.exe,prohibitied

lookups/zoom_first_time_child_process.yml

@@ -0,0 +1,4 @@
+description: A list of suspicious file names
+collection: zoom_first_time_child_process
+name: zoom_first_time_child_process
+fields_list: _key, dest, process_name, firstTimeSeen, lastTimeSeen

macros/kubernetes_azure.yml

@@ -0,0 +1,3 @@
+definition: sourcetype=mscs:storage:blob:json
+description: customer specific splunk configurations(eg- index, source, sourcetype) for Kubernetes data from Azure. Replace the macro definition with configurations for your Splunk Environmnent.
+name: kubernetes_azure

macros/kubernetes_azure_detect_RBAC_authorization_by_account.yml

@@ -0,0 +1,3 @@
+definition: search *
+description: Use this macro to add additional filters
+name: kubernetes_azure_detect_rbac_authorization_by_account_filter

macros/kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace.yml

@@ -0,0 +1,3 @@
+definition: search *
+description: Use this macro to add additional filters
+name: kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace_filter

macros/kubernetes_azure_detect_sensitive_object_access.yml

@@ -0,0 +1,3 @@
+definition: search *
+description: Use this macro to add additional filters
+name: kubernetes_azure_detect_sensitive_object_access_filter

macros/kubernetes_azure_detect_sensitive_role_access.yml

@@ -0,0 +1,3 @@
+definition: search *
+description: Use this macro to add additional filters
+name: kubernetes_azure_detect_sensitive_role_access_filter

macros/kubernetes_azure_detect_service_accounts_forbidden_failure_access.yml

@@ -0,0 +1,3 @@
+definition: search *
+description: Use this macro to add additional filters
+name: kubernetes_azure_detect_service_accounts_forbidden_failure_access_filter

macros/kubernetes_azure_detect_suspicious_kubectl_calls.yml

@@ -0,0 +1,3 @@
+definition: search *
+description: Use this macro to add additional filters
+name: kubernetes_azure_detect_suspicious_kubectl_calls_filter

macros/kubernetes_azure_pod_scan_fingerprint_detection_filter.yml

@@ -0,0 +1,3 @@
+definition: search *
+description: Use this macro to add additional filters
+name: kubernetes_azure_pod_scan_fingerprint_detection_filter

macros/kubernetes_azure_scan_fingerprint_filter.yml

@@ -0,0 +1,3 @@
+definition: search *
+description: Use this macro to add additional filters
+name: kubernetes_azure_scan_fingerprint_filter

macros/previously_seen_zoom_child_processes_forget_window.yml

@@ -0,0 +1,3 @@
+description: Use this macro to determine how long to keep track of zoom child processes
+definition: -90d@d
+name: previously_seen_zoom_child_processes_forget_window

macros/previously_seen_zoom_child_processes_window.yml

@@ -0,0 +1,3 @@
+description: Use this macro to determine how far back you should be checking for new zoom child processes
+definition: -90d@d
+name: previously_seen_zoom_child_processes_window

package/app.manifest

@@ -5,7 +5,7 @@
     "id": {
       "group": null, 
       "name": "DA-ESS-ContentUpdate", 
-      "version": "1.0.54"
+      "version": "3.0.1"
     }, 
     "author": [
       {

package/default/analytic_stories.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security-content
-# On Date: 2020-05-25T14:45:46 UTC
+# On Date: 2020-06-04T22:46:46 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -16,7 +16,7 @@ version = 1
 reference = ["https://aws.amazon.com/blogs/security/aws-cloudtrail-now-tracks-cross-account-activity-to-its-origin/"]
 detection_searches = ["ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule"]
 mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.AE"]}
-investigative_searches = ["ESCU - AWS Investigate User Activities By Source User", "ESCU - Get Notable History", "ESCU - AWS Investigate User Activities By AccessKeyId"]
+investigative_searches = ["ESCU - Get Notable History", "ESCU - AWS Investigate User Activities By AccessKeyId", "ESCU - AWS Investigate User Activities By Source User"]
 support_searches = ["ESCU - Previously Seen AWS Cross Account Activity"]
 data_models = []
 providing_technologies = none
@@ -34,8 +34,8 @@ version = 1
 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
 detection_searches = ["ESCU - Abnormally High AWS Instances Launched by User - Rule", "ESCU - EC2 Instance Started In Previously Unseen Region - Rule", "ESCU - EC2 Instance Started With Previously Unseen AMI - Rule", "ESCU - EC2 Instance Started With Previously Unseen Instance Type - Rule", "ESCU - EC2 Instance Started With Previously Unseen User - Rule"]
 mappings = {"cis20": ["CIS 1", "CIS 12", "CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.AE", "DE.DP", "ID.AM"]}
-investigative_searches = ["ESCU - Get User Information from Identity Table", "ESCU - AWS Investigate User Activities By ARN", "ESCU - Investigate AWS activities via region name", "ESCU - Get Notable History", "ESCU - Get EC2 Instance Details by instanceId", "ESCU - Get Notable Info", "ESCU - Get EC2 Launch Details"]
-support_searches = ["ESCU - Previously Seen EC2 Launches By User", "ESCU - Previously Seen AWS Regions", "ESCU - Previously Seen EC2 Instance Types", "ESCU - Previously Seen EC2 AMIs"]
+investigative_searches = ["ESCU - Get EC2 Instance Details by instanceId", "ESCU - Get Notable Info", "ESCU - Get EC2 Launch Details", "ESCU - Get User Information from Identity Table", "ESCU - Get Notable History", "ESCU - Investigate AWS activities via region name", "ESCU - AWS Investigate User Activities By ARN"]
+support_searches = ["ESCU - Previously Seen EC2 Instance Types", "ESCU - Previously Seen AWS Regions", "ESCU - Previously Seen EC2 Launches By User", "ESCU - Previously Seen EC2 AMIs"]
 data_models = []
 providing_technologies = none
 description = Monitor your AWS EC2 instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or EC2 instances started by previously unseen users are just a few examples of potentially malicious behavior.
@@ -53,8 +53,8 @@ version = 2
 reference = ["https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Appendix_NACLs.html", "https://aws.amazon.com/blogs/security/how-to-help-prepare-for-ddos-attacks-by-reducing-your-attack-surface/"]
 detection_searches = ["ESCU - AWS Network Access Control List Created with All Open Ports - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - Detect Spike in Network ACL Activity - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule"]
 mappings = {"cis20": ["CIS 11", "CIS 12"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "nist": ["DE.AE", "DE.CM", "DE.DP", "PR.AC"]}
-investigative_searches = ["ESCU - AWS Network ACL Details from ID", "ESCU - Get DNS Server History for a host", "ESCU - AWS Investigate User Activities By ARN", "ESCU - Get Process Responsible For The DNS Traffic", "ESCU - Get Notable History", "ESCU - Get Process Info", "ESCU - Get All AWS Activity From IP Address", "ESCU - Get DNS traffic ratio", "ESCU - Get Process Information For Port Activity", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - AWS Network Interface details via resourceId", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table"]
-support_searches = ["ESCU - Baseline of blocked outbound traffic from AWS", "ESCU - Baseline of Network ACL Activity by ARN"]
+investigative_searches = ["ESCU - Get Process Responsible For The DNS Traffic", "ESCU - Get Risk Modifiers For User", "ESCU - Get Process Information For Port Activity", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable Info", "ESCU - AWS Network Interface details via resourceId", "ESCU - AWS Network ACL Details from ID", "ESCU - Get All AWS Activity From IP Address", "ESCU - Get User Information from Identity Table", "ESCU - Get Notable History", "ESCU - Get DNS traffic ratio", "ESCU - Get DNS Server History for a host", "ESCU - AWS Investigate User Activities By ARN"]
+support_searches = ["ESCU - Baseline of Network ACL Activity by ARN", "ESCU - Baseline of blocked outbound traffic from AWS"]
 data_models = []
 providing_technologies = none
 description = Monitor your AWS network infrastructure for bad configurations and malicious activity. Investigative searches help you probe deeper, when the facts warrant it.
@@ -69,7 +69,7 @@ version = 1
 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
 detection_searches = ["ESCU - AWS Cloud Provisioning From Previously Unseen City - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen Country - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen IP Address - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen Region - Rule"]
 mappings = {"cis20": ["CIS 1"], "nist": ["ID.AM"]}
-investigative_searches = ["ESCU - Get All AWS Activity From IP Address", "ESCU - Get All AWS Activity From Region", "ESCU - Get All AWS Activity From Country", "ESCU - Get All AWS Activity From City"]
+investigative_searches = ["ESCU - Get All AWS Activity From Country", "ESCU - Get All AWS Activity From City", "ESCU - Get All AWS Activity From Region", "ESCU - Get All AWS Activity From IP Address"]
 support_searches = ["ESCU - Previously Seen AWS Provisioning Activity Sources"]
 data_models = []
 providing_technologies = none
@@ -86,8 +86,8 @@ version = 1
 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://redlock.io/blog/cryptojacking-tesla"]
 detection_searches = ["ESCU - Detect API activity from users without MFA - Rule", "ESCU - Detect AWS API Activities From Unapproved Accounts - Rule", "ESCU - Detect Spike in AWS API Activity - Rule", "ESCU - Detect Spike in Security Group Activity - Rule", "ESCU - Detect new API calls from user roles - Rule"]
 mappings = {"cis20": ["CIS 1", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.CM", "DE.DP", "ID.AM", "PR.AC"]}
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Investigate AWS User Activities by user field"]
-support_searches = ["ESCU - Baseline of API Calls per User ARN", "ESCU - Baseline of Security Group Activity by ARN", "ESCU - Previously seen API call per user roles in CloudTrail", "ESCU - Create a list of approved AWS service accounts"]
+investigative_searches = ["ESCU - Investigate AWS User Activities by user field", "ESCU - Get Notable History", "ESCU - Get Notable Info"]
+support_searches = ["ESCU - Baseline of Security Group Activity by ARN", "ESCU - Previously seen API call per user roles in CloudTrail", "ESCU - Baseline of API Calls per User ARN", "ESCU - Create a list of approved AWS service accounts"]
 data_models = []
 providing_technologies = none
 description = Detect and investigate dormant user accounts for your AWS environment that have become active again. Because inactive and ad-hoc accounts are common attack targets, it's critical to enable governance within your environment.
@@ -105,7 +105,7 @@ version = 1
 reference = []
 detection_searches = ["ESCU - Detect Excessive Account Lockouts From Endpoint - Rule", "ESCU - Detect Excessive User Account Lockouts - Rule", "ESCU - Identify New User Accounts - Rule", "ESCU - Short Lived Windows Accounts - Rule"]
 mappings = {"cis20": ["CIS 16"], "mitre_attack": ["T1078", "T1136"], "nist": ["PR.IP"]}
-investigative_searches = ["ESCU - Get Logon Rights Modifications For Endpoint", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For User", "ESCU - Get Logon Rights Modifications For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table"]
+investigative_searches = ["ESCU - Get Risk Modifiers For User", "ESCU - Get Logon Rights Modifications For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table", "ESCU - Get Notable History", "ESCU - Get Logon Rights Modifications For Endpoint"]
 support_searches = []
 data_models = ["Change"]
 providing_technologies = none
@@ -121,7 +121,7 @@ version = 1
 reference = ["https://github.com/SpiderLabs/owasp-modsecurity-crs/blob/v3.2/dev/rules/REQUEST-944-APPLICATION-ATTACK-JAVA.conf"]
 detection_searches = ["ESCU - Suspicious Java Classes - Rule", "ESCU - Unusually Long Content-Type Length - Rule", "ESCU - Web Servers Executing Suspicious Processes - Rule"]
 mappings = {"cis20": ["CIS 12", "CIS 18", "CIS 3", "CIS 4"], "kill_chain_phases": ["Actions on Objectives", "Delivery", "Exploitation"], "mitre_attack": ["T1082"], "nist": ["DE.AE", "DE.CM", "ID.RA", "PR.IP", "PR.MA", "PR.PT", "RS.MI"]}
-investigative_searches = ["ESCU - Get Notable History", "ESCU - Get Risk Modifiers For User", "ESCU - Investigate Suspicious Strings in HTTP Header", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Investigate Web POSTs From src", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table"]
+investigative_searches = ["ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable Info", "ESCU - Investigate Suspicious Strings in HTTP Header", "ESCU - Investigate Web POSTs From src", "ESCU - Get User Information from Identity Table", "ESCU - Get Notable History"]
 support_searches = []
 data_models = ["Endpoint"]
 providing_technologies = none
@@ -150,7 +150,7 @@ version = 1
 reference = ["https://www.cisecurity.org/controls/inventory-of-authorized-and-unauthorized-devices/"]
 detection_searches = ["ESCU - Detect Unauthorized Assets by MAC address - Rule"]
 mappings = {"cis20": ["CIS 1"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.DS"]}
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get First Occurrence and Last Occurrence of a MAC Address"]
+investigative_searches = ["ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get First Occurrence and Last Occurrence of a MAC Address"]
 support_searches = ["ESCU - Count of assets by category"]
 data_models = ["Network_Sessions"]
 providing_technologies = none
@@ -166,7 +166,7 @@ version = 1
 reference = ["https://www.zerofox.com/blog/what-is-digital-risk-monitoring/", "https://securingtomorrow.mcafee.com/consumer/family-safety/what-is-typosquatting/", "https://blog.malwarebytes.com/cybercrime/2016/06/explained-typosquatting/"]
 detection_searches = ["ESCU - Monitor DNS For Brand Abuse - Rule", "ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Monitor Web Traffic For Brand Abuse - Rule"]
 mappings = {"cis20": ["CIS 7"], "kill_chain_phases": ["Actions on Objectives", "Delivery"], "nist": ["PR.IP"]}
-investigative_searches = ["ESCU - Get Process Responsible For The DNS Traffic", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For User", "ESCU - Investigate Web Activity From Host", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Emails From Specific Sender", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Email Info", "ESCU - Get User Information from Identity Table"]
+investigative_searches = ["ESCU - Get Process Responsible For The DNS Traffic", "ESCU - Get Emails From Specific Sender", "ESCU - Get Email Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table", "ESCU - Investigate Web Activity From Host", "ESCU - Get Notable History"]
 support_searches = ["ESCU - DNSTwist Domain Names"]
 data_models = ["Email", "Network_Resolution", "Web"]
 providing_technologies = none
@@ -184,8 +184,8 @@ version = 1
 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
 detection_searches = ["ESCU - Abnormally High AWS Instances Launched by User - MLTK - Rule", "ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule", "ESCU - Cloud Compute Instance Started In Previously Unused Region - Rule"]
 mappings = {"cis20": ["CIS 1", "CIS 12", "CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.AE", "DE.DP", "ID.AM"]}
-investigative_searches = ["ESCU - Get User Information from Identity Table", "ESCU - AWS Investigate User Activities By ARN", "ESCU - Investigate AWS activities via region name", "ESCU - Investigate User Activities In Single Cloud Region", "ESCU - Get Notable History", "ESCU - Investigate User Activities In All Cloud Regions", "ESCU - Get EC2 Instance Details by instanceId", "ESCU - Investigate Cloud Compute Instance Activities", "ESCU - Get Notable Info", "ESCU - Get EC2 Launch Details"]
-support_searches = ["ESCU - Previously Seen Cloud Compute Images", "ESCU - Previously Seen Cloud Regions", "ESCU - Previously Seen Cloud Compute Creations By User", "ESCU - Baseline of Excessive AWS Instances Launched by User - MLTK", "ESCU - Previously Seen Cloud Compute Instance Types"]
+investigative_searches = ["ESCU - Get EC2 Instance Details by instanceId", "ESCU - Get Notable Info", "ESCU - Get EC2 Launch Details", "ESCU - Get User Information from Identity Table", "ESCU - Get Notable History", "ESCU - Investigate Cloud Compute Instance Activities", "ESCU - Investigate AWS activities via region name", "ESCU - AWS Investigate User Activities By ARN", "ESCU - Investigate User Activities In All Cloud Regions", "ESCU - Investigate User Activities In Single Cloud Region"]
+support_searches = ["ESCU - Previously Seen Cloud Regions", "ESCU - Baseline of Excessive AWS Instances Launched by User - MLTK", "ESCU - Previously Seen Cloud Compute Images", "ESCU - Previously Seen Cloud Compute Creations By User", "ESCU - Previously Seen Cloud Compute Instance Types"]
 data_models = ["Cloud_Infrastructure"]
 providing_technologies = none
 description = Monitor your cloud compute instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or compute instances started by previously unseen users are just a few examples of potentially malicious behavior.
@@ -203,7 +203,7 @@ version = 1
 reference = ["https://www.intego.com/mac-security-blog/osxcoldroot-and-the-rat-invasion/", "https://objective-see.com/blog/blog_0x2A.html", "https://www.bleepingcomputer.com/news/security/coldroot-rat-still-undetectable-despite-being-uploaded-on-github-two-years-ago/"]
 detection_searches = ["ESCU - Osquery pack - ColdRoot detection - Rule", "ESCU - Processes Tapping Keyboard Events - Rule"]
 mappings = {"cis20": ["CIS 4", "CIS 8"], "kill_chain_phases": ["Command and Control"], "nist": ["DE.DP", "PR.PT"]}
-investigative_searches = ["ESCU - Investigate Network Traffic From src ip", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Investigate Web Activity From src ip", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table"]
+investigative_searches = ["ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Investigate Network Traffic From src ip", "ESCU - Get User Information from Identity Table", "ESCU - Get Notable History", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Investigate Web Activity From src ip"]
 support_searches = []
 data_models = []
 providing_technologies = none
@@ -221,7 +221,7 @@ version = 1
 reference = ["https://attack.mitre.org/wiki/Collection", "https://attack.mitre.org/wiki/Technique/T1074"]
 detection_searches = ["ESCU - Email files written outside of the Outlook directory - Rule", "ESCU - Email servers sending high volume traffic to hosts - Rule", "ESCU - Hosts receiving high volume of network traffic from email server - Rule", "ESCU - Suspicious writes to System Volume Information - Rule", "ESCU - Suspicious writes to windows Recycle Bin - Rule"]
 mappings = {"cis20": ["CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1043", "T1074", "T1114"], "nist": ["DE.AE", "DE.CM", "PR.PT"]}
-investigative_searches = ["ESCU - Get Parent Process Info", "ESCU - Get Notable History", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table"]
+investigative_searches = ["ESCU - Get Risk Modifiers For User", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get User Information from Identity Table", "ESCU - Get Notable History"]
 support_searches = []
 data_models = ["Endpoint", "Network_Traffic"]
 providing_technologies = none
@@ -239,8 +239,8 @@ version = 1
 reference = ["https://attack.mitre.org/wiki/Command_and_Control", "https://searchsecurity.techtarget.com/feature/Command-and-control-servers-The-puppet-masters-that-govern-malware"]
 detection_searches = ["ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Detect Large Outbound ICMP Packets - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - TOR Traffic - Rule"]
 mappings = {"cis20": ["CIS 1", "CIS 11", "CIS 12", "CIS 13", "CIS 3", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery"], "mitre_attack": ["T1043", "T1048", "T1095"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.AC", "PR.DS", "PR.IP", "PR.PT"]}
-investigative_searches = ["ESCU - AWS Network ACL Details from ID", "ESCU - Get DNS Server History for a host", "ESCU - AWS Investigate User Activities By ARN", "ESCU - Get Process Responsible For The DNS Traffic", "ESCU - Get Parent Process Info", "ESCU - Get Notable History", "ESCU - Get Process Info", "ESCU - Get All AWS Activity From IP Address", "ESCU - Get DNS traffic ratio", "ESCU - Get Process Information For Port Activity", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - AWS Network Interface details via resourceId", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table"]
-support_searches = ["ESCU - Baseline of blocked outbound traffic from AWS", "ESCU - Baseline of DNS Query Length - MLTK"]
+investigative_searches = ["ESCU - Get Process Responsible For The DNS Traffic", "ESCU - Get Risk Modifiers For User", "ESCU - Get Process Information For Port Activity", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable Info", "ESCU - AWS Network Interface details via resourceId", "ESCU - AWS Network ACL Details from ID", "ESCU - Get All AWS Activity From IP Address", "ESCU - Get Parent Process Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get DNS traffic ratio", "ESCU - Get DNS Server History for a host", "ESCU - AWS Investigate User Activities By ARN"]
+support_searches = ["ESCU - Baseline of DNS Query Length - MLTK", "ESCU - Baseline of blocked outbound traffic from AWS"]
 data_models = ["Network_Resolution", "Network_Traffic"]
 providing_technologies = none
 description = Detect and investigate tactics, techniques, and procedures leveraged by attackers to establish and operate command and control channels. Implants installed by attackers on compromised endpoints use these channels to receive instructions and send data back to the malicious operators.
@@ -289,7 +289,7 @@ version = 3
 reference = ["https://attack.mitre.org/wiki/Technique/T1003", "https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html"]
 detection_searches = ["ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Attempt To Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule"]
 mappings = {"cis20": ["CIS 16", "CIS 3", "CIS 5", "CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Installation"], "mitre_attack": ["T1003", "T1064", "T1086"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.IP"]}
-investigative_searches = ["ESCU - Investigate Failed Logins for Multiple Destinations", "ESCU - Investigate Previous Unseen User", "ESCU - Investigate Pass the Hash Attempts", "ESCU - Investigate Pass the Ticket Attempts"]
+investigative_searches = ["ESCU - Investigate Pass the Hash Attempts", "ESCU - Investigate Previous Unseen User", "ESCU - Investigate Pass the Ticket Attempts", "ESCU - Investigate Failed Logins for Multiple Destinations"]
 support_searches = []
 data_models = ["Endpoint"]
 providing_technologies = none
@@ -307,8 +307,8 @@ version = 2
 reference = ["https://www.us-cert.gov/ncas/alerts/TA18-074A"]
 detection_searches = ["ESCU - Create local admin accounts using net exe - Rule", "ESCU - Detect New Local Admin account - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Scheduled Task Name Used by Dragonfly Threat Actors - Rule", "ESCU - Single Letter Process On Endpoint - Rule", "ESCU - Suspicious Reg exe Process - Rule"]
 mappings = {"cis20": ["CIS 12", "CIS 16", "CIS 2", "CIS 3", "CIS 5", "CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Installation"], "mitre_attack": ["T1031", "T1043", "T1050", "T1053", "T1059", "T1064", "T1078", "T1086", "T1089", "T1103", "T1112", "T1131"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.AC", "PR.AT", "PR.DS", "PR.IP", "PR.PT"]}
-investigative_searches = ["ESCU - Get Parent Process Info", "ESCU - Get Notable History", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get Process Information For Port Activity", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Investigate Web Activity From Host", "ESCU - Get Process Registry Activity", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Process File Activity", "ESCU - Get User Information from Identity Table", "ESCU - Get Registry Activities"]
-support_searches = ["ESCU - Baseline of SMB Traffic - MLTK", "ESCU - Previously seen command line arguments"]
+investigative_searches = ["ESCU - Get Risk Modifiers For User", "ESCU - Get Process Information For Port Activity", "ESCU - Get Process Info", "ESCU - Get Process Registry Activity", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Parent Process Info", "ESCU - Get User Information from Identity Table", "ESCU - Investigate Web Activity From Host", "ESCU - Get Notable History", "ESCU - Get Registry Activities", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Process File Activity"]
+support_searches = ["ESCU - Previously seen command line arguments", "ESCU - Baseline of SMB Traffic - MLTK"]
 data_models = ["Endpoint", "Network_Traffic"]
 providing_technologies = none
 description = Monitor for suspicious activities associated with DHS Technical Alert US-CERT TA18-074A. Some of the activities that adversaries used in these compromises included spearfishing attacks, malware, watering-hole domains, many and more.
@@ -326,7 +326,7 @@ version = 1
 reference = ["https://www.us-cert.gov/ncas/alerts/TA13-088A", "https://www.imperva.com/learn/application-security/dns-amplification/"]
 detection_searches = ["ESCU - Large Volume of DNS ANY Queries - Rule"]
 mappings = {"cis20": ["CIS 12"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.IP"]}
-investigative_searches = ["ESCU - Get Risk Modifiers For User", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For Endpoint"]
+investigative_searches = ["ESCU - Get Risk Modifiers For User", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Risk Modifiers For Endpoint"]
 support_searches = []
 data_models = ["Network_Resolution"]
 providing_technologies = none
@@ -367,7 +367,7 @@ version = 1
 reference = ["https://www.cisecurity.org/controls/data-protection/", "https://www.sans.org/reading-room/whitepapers/dns/splunk-detect-dns-tunneling-37022", "https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/"]
 detection_searches = ["ESCU - Detect USB device insertion - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule"]
 mappings = {"cis20": ["CIS 12", "CIS 13", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1043"], "nist": ["DE.AE", "DE.CM", "PR.DS", "PR.PT"]}
-investigative_searches = ["ESCU - Get DNS Server History for a host", "ESCU - Get Process Responsible For The DNS Traffic", "ESCU - Get Notable History", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get DNS traffic ratio", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table"]
+investigative_searches = ["ESCU - Get Process Responsible For The DNS Traffic", "ESCU - Get Risk Modifiers For User", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table", "ESCU - Get Notable History", "ESCU - Get DNS traffic ratio", "ESCU - Get DNS Server History for a host"]
 support_searches = []
 data_models = ["Change_Analysis", "Network_Resolution"]
 providing_technologies = none
@@ -383,8 +383,8 @@ version = 2
 reference = ["https://attack.mitre.org/wiki/Technique/T1089", "https://blog.malwarebytes.com/cybercrime/2015/11/vonteera-adware-uses-certificates-to-disable-anti-malware/", "https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Tools-Report.pdf"]
 detection_searches = ["ESCU - Attempt To Add Certificate To Untrusted Store - Rule", "ESCU - Attempt To Stop Security Service - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Unload Sysmon Filter Driver - Rule"]
 mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Installation"], "mitre_attack": ["T1031", "T1050", "T1059", "T1089", "T1112"], "nist": ["DE.CM", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]}
-investigative_searches = ["ESCU - Get Parent Process Info", "ESCU - Get Notable History", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Investigate Web Activity From Host", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table"]
-support_searches = ["ESCU - Baseline of SMB Traffic - MLTK", "ESCU - Previously seen command line arguments"]
+investigative_searches = ["ESCU - Get Risk Modifiers For User", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get User Information from Identity Table", "ESCU - Investigate Web Activity From Host", "ESCU - Get Notable History"]
+support_searches = ["ESCU - Previously seen command line arguments", "ESCU - Baseline of SMB Traffic - MLTK"]
 data_models = ["Endpoint"]
 providing_technologies = none
 description = Looks for activities and techniques associated with the disabling of security tools on a Windows system, such as suspicious `reg.exe` processes, processes launching netsh, and many others.
@@ -399,7 +399,7 @@ version = 2
 reference = ["https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html", "https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/", "http://www.noip.com/blog/2014/07/11/dynamic-dns-can-use-2/", "https://www.splunk.com/blog/2015/08/04/detecting-dynamic-dns-domains-in-splunk.html"]
 detection_searches = ["ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detect web traffic to dynamic domain providers - Rule"]
 mappings = {"cis20": ["CIS 13", "CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1041"], "nist": ["DE.CM", "DE.DP", "PR.IP"]}
-investigative_searches = ["ESCU - Get DNS Server History for a host", "ESCU - Get Process Responsible For The DNS Traffic", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For User", "ESCU - Get DNS traffic ratio", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Investigate Web Activity From src ip", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table"]
+investigative_searches = ["ESCU - Get Process Responsible For The DNS Traffic", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table", "ESCU - Get Notable History", "ESCU - Get DNS traffic ratio", "ESCU - Get DNS Server History for a host", "ESCU - Investigate Web Activity From src ip"]
 support_searches = []
 data_models = ["Network_Resolution", "Web"]
 providing_technologies = none
@@ -415,8 +415,8 @@ version = 1
 reference = ["https://www.us-cert.gov/ncas/alerts/TA18-201A", "https://www.first.org/resources/papers/conf2017/Advanced-Incident-Detection-and-Threat-Hunting-using-Sysmon-and-Splunk.pdf", "https://www.vkremez.com/2017/05/emotet-banking-trojan-malware-analysis.html"]
 detection_searches = ["ESCU - Detect Rare Executables - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - Detection of tools built by NirSoft - Rule", "ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule"]
 mappings = {"cis20": ["CIS 12", "CIS 2", "CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery", "Exploitation", "Installation"], "mitre_attack": ["T1043", "T1059", "T1072", "T1087", "T1103", "T1131"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.DS", "PR.IP", "PR.PT"]}
-investigative_searches = ["ESCU - Get Parent Process Info", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Registry Activities"]
-support_searches = ["ESCU - Baseline of SMB Traffic - MLTK", "ESCU - Add Prohibited Processes to Enterprise Security"]
+investigative_searches = ["ESCU - Get Risk Modifiers For User", "ESCU - Get Process Information For Port Activity", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Parent Process Info", "ESCU - Get User Information from Identity Table", "ESCU - Investigate Web Activity From Host", "ESCU - Get Notable History", "ESCU - Get Registry Activities", "ESCU - Get Vulnerability Logs For Endpoint"]
+support_searches = ["ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Baseline of SMB Traffic - MLTK"]
 data_models = ["Email", "Endpoint", "Network_Traffic"]
 providing_technologies = none
 description = Detect rarely used executables, specific registry paths that may confer malware survivability and persistence, instances where cmd.exe is used to launch script interpreters, and other indicators that the Emotet financial malware has compromised your environment.
@@ -433,8 +433,8 @@ version = 2
 reference = ["https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity", "https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf"]
 detection_searches = ["ESCU - Create or delete windows shares using net exe - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Suspicious File Write - Rule"]
 mappings = {"cis20": ["CIS 12", "CIS 16", "CIS 3", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1043", "T1059", "T1064", "T1076"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.IP", "PR.PT"]}
-investigative_searches = ["ESCU - Get DNS Server History for a host", "ESCU - Get Process Responsible For The DNS Traffic", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Get Parent Process Info", "ESCU - Get Notable History", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get DNS traffic ratio", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table"]
-support_searches = ["ESCU - Baseline of SMB Traffic - MLTK", "ESCU - Baseline of DNS Query Length - MLTK", "ESCU - Previously seen command line arguments"]
+investigative_searches = ["ESCU - Get Process Responsible For The DNS Traffic", "ESCU - Get Risk Modifiers For User", "ESCU - Get Process Information For Port Activity", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get User Information from Identity Table", "ESCU - Investigate Web Activity From Host", "ESCU - Get Notable History", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get DNS traffic ratio", "ESCU - Get DNS Server History for a host", "ESCU - Investigate Successful Remote Desktop Authentications"]
+support_searches = ["ESCU - Baseline of DNS Query Length - MLTK", "ESCU - Previously seen command line arguments", "ESCU - Baseline of SMB Traffic - MLTK"]
 data_models = ["Endpoint", "Network_Resolution", "Network_Traffic"]
 providing_technologies = none
 description = Monitor for and investigate activities, including the creation or deletion of hidden shares and file writes, that may be evidence of infiltration by North Korean government-sponsored cybercriminals. Details of this activity were reported in DHS Report TA-18-149A.
@@ -452,7 +452,7 @@ version = 1
 reference = ["https://blog.malwarebytes.com/cybercrime/2016/09/hosts-file-hijacks/"]
 detection_searches = ["ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Windows hosts file modification - Rule"]
 mappings = {"cis20": ["CIS 1", "CIS 12", "CIS 13", "CIS 3", "CIS 8"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1048"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.AC", "PR.DS", "PR.IP", "PR.PT"]}
-investigative_searches = ["ESCU - Get DNS Server History for a host", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table"]
+investigative_searches = ["ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table", "ESCU - Get Notable History", "ESCU - Get DNS Server History for a host"]
 support_searches = []
 data_models = ["Network_Resolution"]
 providing_technologies = none
@@ -468,7 +468,7 @@ version = 1
 reference = ["http://www.deependresearch.org/2016/04/jboss-exploits-view-from-victim.html"]
 detection_searches = ["ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule", "ESCU - Detect malicious requests to exploit JBoss servers - Rule"]
 mappings = {"cis20": ["CIS 18"], "kill_chain_phases": ["Delivery", "Reconnaissance"], "mitre_attack": ["T1082"], "nist": ["DE.CM"]}
-investigative_searches = ["ESCU - Get Notable History", "ESCU - Investigate Web Activity From Host", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Notable Info"]
+investigative_searches = ["ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable Info", "ESCU - Investigate Web Activity From Host", "ESCU - Get Notable History", "ESCU - Get Vulnerability Logs For Endpoint"]
 support_searches = []
 data_models = ["Web"]
 providing_technologies = none
@@ -496,15 +496,47 @@ modification_date = 2020-04-15
 id = a9ef59cf-e981-4e66-9eef-bb049f695c09
 version = 1
 reference = ["https://github.com/splunk/cloud-datamodel-security-research"]
-detection_searches = ["ESCU - Amazon EKS Kubernetes Pod scan detection - Rule", "ESCU - Amazon EKS Kubernetes cluster scan detection - Rule", "ESCU - GCP Kubernetes cluster scan detection - Rule"]
+detection_searches = ["ESCU - Amazon EKS Kubernetes Pod scan detection - Rule", "ESCU - Amazon EKS Kubernetes cluster scan detection - Rule", "ESCU - GCP Kubernetes cluster scan detection - Rule", "ESCU - Kubernetes Azure pod scan fingerprint - Rule", "ESCU - Kubernetes Azure scan fingerprint - Rule"]
 mappings = {"kill_chain_phases": ["Reconnaissance"]}
-investigative_searches = ["ESCU - GCP Kubernetes activity by src ip", "ESCU - Amazon EKS Kubernetes activity by src ip", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable Info"]
+investigative_searches = ["ESCU - Amazon EKS Kubernetes activity by src ip", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - GCP Kubernetes activity by src ip"]
 support_searches = []
 data_models = []
 providing_technologies = none
 description = This story addresses detection against Kubernetes cluster fingerprint scan and attack by providing information on items such as source ip, user agent, cluster names.
 narrative = Kubernetes is the most used container orchestration platform, this orchestration platform contains sensitve information and management priviledges of production workloads, microservices and applications. These searches allow operator to detect suspicious unauthenticated requests from the internet to kubernetes cluster.
 
+[Kubernetes Sensitive Object Access Activity]
+category =  Cloud Security
+creation_date = 2020-05-20
+modification_date = 2020-05-20
+id = 2574e6d9-7254-4751-8925-0447deeec8ea
+version = 1
+reference = ["https://www.splunk.com/en_us/blog/security/approaching-kubernetes-security-detecting-kubernetes-scan-with-splunk.html"]
+detection_searches = ["ESCU - Kubernetes Azure detect sensitive object access - Rule", "ESCU - Kubernetes Azure detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes Azure detect suspicious kubectl calls - Rule"]
+mappings = {"kill_chain_phases": ["Lateral Movement"]}
+investigative_searches = ["ESCU - Get Notable Info"]
+support_searches = []
+data_models = []
+providing_technologies = none
+description = This story addresses detection and response of accounts acccesing Kubernetes cluster sensitive objects such as configmaps or secrets providing information on items such as user user, group. object, namespace and authorization reason.
+narrative = Kubernetes is the most used container orchestration platform, this orchestration platform contains sensitive objects within its architecture, specifically configmaps and secrets, if accessed by an attacker can lead to further compromise. These searches allow operator to detect suspicious requests against Kubernetes sensitive objects.
+
+[Kubernetes Sensitive Role Activity]
+category =  Cloud Security
+creation_date = 2020-05-20
+modification_date = 2020-05-20
+id = 2574e6d9-7254-4751-8925-0447deeec8ew
+version = 1
+reference = ["https://www.splunk.com/en_us/blog/security/approaching-kubernetes-security-detecting-kubernetes-scan-with-splunk.html"]
+detection_searches = ["ESCU - Kubernetes Azure detect RBAC authorization by account - Rule", "ESCU - Kubernetes Azure detect most active service accounts by pod namespace - Rule", "ESCU - Kubernetes Azure detect sensitive role access - Rule"]
+mappings = {"kill_chain_phases": ["Lateral Movement"]}
+investigative_searches = ["ESCU - Get Notable Info"]
+support_searches = []
+data_models = []
+providing_technologies = none
+description = This story addresses detection and response around Sensitive Role usage within a Kubernetes clusters against cluster resources and namespaces.
+narrative = Kubernetes is the most used container orchestration platform, this orchestration platform contains sensitive roles within its architecture, specifically configmaps and secrets, if accessed by an attacker can lead to further compromise. These searches allow operator to detect suspicious requests against Kubernetes role activities
+
 [Lateral Movement]
 category =  Adversary Tactics
 creation_date = 2020-02-04
@@ -514,7 +546,7 @@ version = 2
 reference = ["https://www.fireeye.com/blog/executive-perspective/2015/08/malware_lateral_move.html"]
 detection_searches = ["ESCU - Detect Activity Related to Pass the Hash Attacks - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - Schtasks scheduling job on remote system - Rule"]
 mappings = {"cis20": ["CIS 16", "CIS 3", "CIS 9"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1053", "T1075", "T1076"], "nist": ["DE.AE", "PR.AC", "PR.IP"]}
-investigative_searches = ["ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Get Parent Process Info", "ESCU - Get Notable History", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get Process Information For Port Activity", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table"]
+investigative_searches = ["ESCU - Get Risk Modifiers For User", "ESCU - Get Process Information For Port Activity", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get User Information from Identity Table", "ESCU - Get Notable History", "ESCU - Investigate Successful Remote Desktop Authentications"]
 support_searches = []
 data_models = ["Endpoint", "Network_Traffic"]
 providing_technologies = none
@@ -534,7 +566,7 @@ version = 4
 reference = ["https://blogs.mcafee.com/mcafee-labs/malware-employs-powershell-to-infect-systems/", "https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"]
 detection_searches = ["ESCU - Attempt To Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments - Rule", "ESCU - Malicious PowerShell Process With Obfuscation Techniques - Rule"]
 mappings = {"cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1064", "T1086"], "nist": ["DE.CM", "PR.IP", "PR.PT"]}
-investigative_searches = ["ESCU - Get Parent Process Info", "ESCU - Get Notable History", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table"]
+investigative_searches = ["ESCU - Get Risk Modifiers For User", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get User Information from Identity Table", "ESCU - Get Notable History"]
 support_searches = []
 data_models = ["Endpoint"]
 providing_technologies = none
@@ -559,7 +591,7 @@ version = 1
 reference = ["https://www.carbonblack.com/2016/03/04/tracking-locky-ransomware-using-carbon-black/"]
 detection_searches = ["ESCU - Extended Period Without Successful Netbackup Backups - Rule", "ESCU - Unsuccessful Netbackup backups - Rule"]
 mappings = {"cis20": ["CIS 10"], "nist": ["PR.IP"]}
-investigative_searches = ["ESCU - Get Risk Modifiers For User", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - All backup logs for host"]
+investigative_searches = ["ESCU - All backup logs for host", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint"]
 support_searches = ["ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups"]
 data_models = []
 providing_technologies = none
@@ -575,7 +607,7 @@ version = 1
 reference = ["https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"]
 detection_searches = ["ESCU - Prohibited Software On Endpoint - Rule"]
 mappings = {"cis20": ["CIS 2"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.DS"]}
-investigative_searches = ["ESCU - Get Parent Process Info", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Investigate Web Activity From Host", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table"]
+investigative_searches = ["ESCU - Get Risk Modifiers For User", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Parent Process Info", "ESCU - Get User Information from Identity Table", "ESCU - Investigate Web Activity From Host", "ESCU - Get Notable History", "ESCU - Get Vulnerability Logs For Endpoint"]
 support_searches = ["ESCU - Add Prohibited Processes to Enterprise Security"]
 data_models = ["Endpoint"]
 providing_technologies = none
@@ -592,7 +624,7 @@ version = 1
 reference = ["https://learn.cisecurity.org/20-controls-download"]
 detection_searches = ["ESCU - No Windows Updates in a time frame - Rule"]
 mappings = {"cis20": ["CIS 18"], "nist": ["PR.MA"]}
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For Endpoint"]
+investigative_searches = ["ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Risk Modifiers For Endpoint"]
 support_searches = []
 data_models = ["Updates"]
 providing_technologies = none
@@ -610,8 +642,8 @@ version = 1
 reference = ["https://technet.microsoft.com/library/bb490939.aspx", "https://htmlpreview.github.io/?https://github.com/MatthewDemaske/blogbackup/blob/master/netshell.html", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html"]
 detection_searches = ["ESCU - Processes created by netsh - Rule", "ESCU - Processes launching netsh - Rule"]
 mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1059", "T1089"], "nist": ["DE.CM", "PR.PT"]}
-investigative_searches = ["ESCU - Get Parent Process Info", "ESCU - Get Notable History", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Investigate Web Activity From Host", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table"]
-support_searches = ["ESCU - Baseline of SMB Traffic - MLTK", "ESCU - Previously seen command line arguments"]
+investigative_searches = ["ESCU - Get Risk Modifiers For User", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get User Information from Identity Table", "ESCU - Investigate Web Activity From Host", "ESCU - Get Notable History"]
+support_searches = ["ESCU - Previously seen command line arguments", "ESCU - Baseline of SMB Traffic - MLTK"]
 data_models = ["Endpoint"]
 providing_technologies = none
 description = Detect activities and various techniques associated with the abuse of `netsh.exe`, which can disable local firewall settings or set up a remote connection to a host from an infected system.
@@ -627,7 +659,7 @@ version = 2
 reference = ["https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia", "https://www.infosecurity-magazine.com/news/healthcare-targeted-by-hacker/"]
 detection_searches = ["ESCU - First Time Seen Running Windows Service - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule"]
 mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Installation"], "mitre_attack": ["T1031", "T1050", "T1059", "T1064", "T1089"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]}
-investigative_searches = ["ESCU - Get Parent Process Info", "ESCU - Get Notable History", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Investigate Web Activity From Host", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table"]
+investigative_searches = ["ESCU - Get Risk Modifiers For User", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get User Information from Identity Table", "ESCU - Investigate Web Activity From Host", "ESCU - Get Notable History"]
 support_searches = ["ESCU - Previously Seen Running Windows Services", "ESCU - Previously seen command line arguments"]
 data_models = ["Endpoint"]
 providing_technologies = none
@@ -670,7 +702,7 @@ version = 1
 reference = ["https://www.infosecurity-magazine.com/news/scope-of-mudcarp-attacks-highlight-1/", "http://blog.amossys.fr/badflick-is-not-so-bad.html"]
 detection_searches = ["ESCU - First time seen command line argument - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule"]
 mappings = {"cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1059", "T1064", "T1086", "T1103", "T1131"], "nist": ["DE.AE", "DE.CM", "PR.IP", "PR.PT"]}
-investigative_searches = ["ESCU - Get Parent Process Info", "ESCU - Get Notable History", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Investigate Web Activity From Host", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Registry Activities"]
+investigative_searches = ["ESCU - Get Risk Modifiers For User", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get User Information from Identity Table", "ESCU - Investigate Web Activity From Host", "ESCU - Get Notable History", "ESCU - Get Registry Activities"]
 support_searches = ["ESCU - Baseline of Command Line Length - MLTK", "ESCU - Previously seen command line arguments"]
 data_models = ["Endpoint"]
 providing_technologies = none
@@ -713,7 +745,7 @@ version = 1
 reference = ["http://www.novetta.com/2015/02/advanced-methods-to-detect-advanced-cyber-attacks-protocol-abuse/"]
 detection_searches = ["ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - TOR Traffic - Rule"]
 mappings = {"cis20": ["CIS 12", "CIS 13", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery"], "mitre_attack": ["T1043", "T1048"], "nist": ["DE.AE", "DE.CM", "PR.AC"]}
-investigative_searches = ["ESCU - Get DNS Server History for a host", "ESCU - Get Parent Process Info", "ESCU - Get Notable History", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get Process Information For Port Activity", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table"]
+investigative_searches = ["ESCU - Get Risk Modifiers For User", "ESCU - Get Process Information For Port Activity", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get User Information from Identity Table", "ESCU - Get Notable History", "ESCU - Get DNS Server History for a host"]
 support_searches = []
 data_models = ["Network_Resolution", "Network_Traffic"]
 providing_technologies = none
@@ -729,7 +761,7 @@ version = 1
 reference = ["https://www.carbonblack.com/2017/06/28/carbon-black-threat-research-technical-analysis-petya-notpetya-ransomware/", "https://www.splunk.com/blog/2017/06/27/closing-the-detection-to-mitigation-gap-or-to-petya-or-notpetya-whocares-.html"]
 detection_searches = ["ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - TOR Traffic - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Windows Event Log Cleared - Rule"]
 mappings = {"cis20": ["CIS 10", "CIS 12", "CIS 3", "CIS 5", "CIS 6", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery"], "mitre_attack": ["T1036", "T1043", "T1047", "T1048", "T1053", "T1070", "T1103", "T1131"], "nist": ["DE.AE", "DE.CM", "DE.DP", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]}
-investigative_searches = ["ESCU - Get Sysmon WMI Activity for Host", "ESCU - Get Parent Process Info", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Registry Activities"]
+investigative_searches = ["ESCU - Get Risk Modifiers For User", "ESCU - Get Process Information For Port Activity", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Parent Process Info", "ESCU - Get User Information from Identity Table", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Registry Activities", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Investigate Web Activity From Host", "ESCU - Get Sysmon WMI Activity for Host"]
 support_searches = ["ESCU - Baseline of Command Line Length - MLTK", "ESCU - Baseline of SMB Traffic - MLTK"]
 data_models = ["Endpoint", "Network_Traffic"]
 providing_technologies = none
@@ -745,7 +777,7 @@ version = 1
 reference = ["https://www.fireeye.com/blog/executive-perspective/2015/09/the_new_route_toper.html", "https://www.cisco.com/c/en/us/about/security-center/event-response/synful-knock.html"]
 detection_searches = ["ESCU - Detect New Login Attempts to Routers - Rule"]
 mappings = {"cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.IP"]}
-investigative_searches = ["ESCU - Get Notable History", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table"]
+investigative_searches = ["ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table", "ESCU - Get Notable History"]
 support_searches = []
 data_models = ["Authentication"]
 providing_technologies = none
@@ -762,7 +794,7 @@ version = 1
 reference = ["https://capec.mitre.org/data/definitions/66.html", "https://www.incapsula.com/web-application-security/sql-injection.html"]
 detection_searches = ["ESCU - SQL Injection with Long URLs - Rule"]
 mappings = {"cis20": ["CIS 18"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1043"], "nist": ["DE.CM"]}
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For Endpoint"]
+investigative_searches = ["ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For Endpoint"]
 support_searches = []
 data_models = ["Web"]
 providing_technologies = none
@@ -779,7 +811,7 @@ version = 1
 reference = ["https://www.crowdstrike.com/blog/an-in-depth-analysis-of-samsam-ransomware-and-boss-spider/", "https://nakedsecurity.sophos.com/2018/07/31/samsam-the-almost-6-million-ransomware/", "https://thehackernews.com/2018/07/samsam-ransomware-attacks.html"]
 detection_searches = ["ESCU - Batch File Write to System32 - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule", "ESCU - Detect malicious requests to exploit JBoss servers - Rule", "ESCU - File with Samsam Extension - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Samsam Test File Write - Rule", "ESCU - Spike in File Writes - Rule"]
 mappings = {"cis20": ["CIS 10", "CIS 12", "CIS 16", "CIS 18", "CIS 2", "CIS 3", "CIS 4", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery", "Installation", "Reconnaissance"], "mitre_attack": ["T1059", "T1076", "T1082"], "nist": ["DE.AE", "DE.CM", "ID.AM", "ID.RA", "PR.AC", "PR.DS", "PR.IP", "PR.MA", "PR.PT"]}
-investigative_searches = ["ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Get Parent Process Info", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table"]
+investigative_searches = ["ESCU - Get Risk Modifiers For User", "ESCU - Get Process Information For Port Activity", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Parent Process Info", "ESCU - Get User Information from Identity Table", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Investigate Web Activity From Host", "ESCU - Investigate Successful Remote Desktop Authentications"]
 support_searches = ["ESCU - Add Prohibited Processes to Enterprise Security"]
 data_models = ["Endpoint", "Network_Traffic", "Web"]
 providing_technologies = none
@@ -800,7 +832,7 @@ version = 1
 reference = ["https://meltdownattack.com/"]
 detection_searches = ["ESCU - Spectre and Meltdown Vulnerable Systems - Rule"]
 mappings = {"cis20": ["CIS 4"], "nist": ["DE.CM"]}
-investigative_searches = ["ESCU - Get Notable History", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table"]
+investigative_searches = ["ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table", "ESCU - Get Notable History"]
 support_searches = ["ESCU - Systems Ready for Spectre-Meltdown Windows Patch"]
 data_models = ["Vulnerabilities"]
 providing_technologies = none
@@ -816,7 +848,7 @@ version = 1
 reference = ["http://www.splunk.com/view/SP-CAAAPQ6#announce", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4859"]
 detection_searches = ["ESCU - Open Redirect in Splunk Web - Rule"]
 mappings = {"cis20": ["CIS 18"], "kill_chain_phases": ["Delivery"], "nist": ["DE.CM"]}
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For Endpoint"]
+investigative_searches = ["ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Risk Modifiers For Endpoint"]
 support_searches = []
 data_models = []
 providing_technologies = none
@@ -841,7 +873,7 @@ version = 1
 reference = ["https://nvd.nist.gov/vuln/detail/CVE-2018-11409", "https://www.splunk.com/view/SP-CAAAP5E#VulnerabilityDescriptionsandRatings", "https://www.exploit-db.com/exploits/44865/"]
 detection_searches = ["ESCU - Splunk Enterprise Information Disclosure - Rule"]
 mappings = {"cis20": ["CIS 18"], "kill_chain_phases": ["Delivery"], "nist": ["DE.CM"]}
-investigative_searches = ["ESCU - Investigate Network Traffic From src ip", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Investigate Web Activity From src ip", "ESCU - Get Notable Info"]
+investigative_searches = ["ESCU - Get Risk Modifiers For Endpoint", "ESCU - Investigate Network Traffic From src ip", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Investigate Web Activity From src ip"]
 support_searches = []
 data_models = []
 providing_technologies = none
@@ -860,7 +892,7 @@ version = 1
 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
 detection_searches = ["ESCU - Abnormally High AWS Instances Launched by User - MLTK - Rule", "ESCU - Abnormally High AWS Instances Launched by User - Rule", "ESCU - Abnormally High AWS Instances Terminated by User - MLTK - Rule", "ESCU - Abnormally High AWS Instances Terminated by User - Rule", "ESCU - EC2 Instance Started In Previously Unseen Region - Rule", "ESCU - EC2 Instance Started With Previously Unseen User - Rule"]
 mappings = {"cis20": ["CIS 1", "CIS 12", "CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.AE", "DE.DP", "ID.AM"]}
-investigative_searches = ["ESCU - Get User Information from Identity Table", "ESCU - AWS Investigate User Activities By ARN", "ESCU - Investigate AWS activities via region name", "ESCU - Get Notable History", "ESCU - Get EC2 Instance Details by instanceId", "ESCU - Get Notable Info", "ESCU - Get EC2 Launch Details"]
+investigative_searches = ["ESCU - Get EC2 Instance Details by instanceId", "ESCU - Get Notable Info", "ESCU - Get EC2 Launch Details", "ESCU - Get User Information from Identity Table", "ESCU - Get Notable History", "ESCU - Investigate AWS activities via region name", "ESCU - AWS Investigate User Activities By ARN"]
 support_searches = ["ESCU - Baseline of Excessive AWS Instances Terminated by User - MLTK", "ESCU - Previously Seen AWS Regions", "ESCU - Baseline of Excessive AWS Instances Launched by User - MLTK", "ESCU - Previously Seen EC2 Launches By User"]
 data_models = []
 providing_technologies = none
@@ -892,7 +924,7 @@ version = 2
 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://www.tripwire.com/state-of-security/security-data-protection/cloud/public-aws-s3-buckets-writable/"]
 detection_searches = ["ESCU - Detect New Open S3 buckets - Rule", "ESCU - Detect S3 access from a new IP - Rule", "ESCU - Detect Spike in S3 Bucket deletion - Rule"]
 mappings = {"cis20": ["CIS 13", "CIS 14"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.CM", "DE.DP", "PR.AC", "PR.DS"]}
-investigative_searches = ["ESCU - Get User Information from Identity Table", "ESCU - AWS Investigate User Activities By ARN", "ESCU - Investigate AWS activities via region name", "ESCU - Get Notable History", "ESCU - Get All AWS Activity From IP Address", "ESCU - Get Notable Info", "ESCU - AWS S3 Bucket details via bucketName"]
+investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table", "ESCU - Get All AWS Activity From IP Address", "ESCU - Get Notable History", "ESCU - Investigate AWS activities via region name", "ESCU - AWS Investigate User Activities By ARN", "ESCU - AWS S3 Bucket details via bucketName"]
 support_searches = ["ESCU - Baseline of S3 Bucket deletion activity by ARN", "ESCU - Previously seen S3 bucket access by remote IP"]
 data_models = []
 providing_technologies = none
@@ -910,7 +942,7 @@ version = 1
 reference = ["https://rhinosecuritylabs.com/aws/hiding-cloudcobalt-strike-beacon-c2-using-amazon-apis/"]
 detection_searches = ["ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule"]
 mappings = {"cis20": ["CIS 11"], "kill_chain_phases": ["Command and Control"], "nist": ["PR.AC"]}
-investigative_searches = ["ESCU - AWS Network ACL Details from ID", "ESCU - Get DNS Server History for a host", "ESCU - AWS Investigate User Activities By ARN", "ESCU - Get Process Responsible For The DNS Traffic", "ESCU - Get Notable History", "ESCU - Get Process Info", "ESCU - Get All AWS Activity From IP Address", "ESCU - Get DNS traffic ratio", "ESCU - Get Process Information For Port Activity", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - AWS Network Interface details via resourceId", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table"]
+investigative_searches = ["ESCU - Get Process Responsible For The DNS Traffic", "ESCU - Get Risk Modifiers For User", "ESCU - Get Process Information For Port Activity", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable Info", "ESCU - AWS Network Interface details via resourceId", "ESCU - AWS Network ACL Details from ID", "ESCU - Get All AWS Activity From IP Address", "ESCU - Get User Information from Identity Table", "ESCU - Get Notable History", "ESCU - Get DNS traffic ratio", "ESCU - Get DNS Server History for a host", "ESCU - AWS Investigate User Activities By ARN"]
 support_searches = ["ESCU - Baseline of blocked outbound traffic from AWS"]
 data_models = []
 providing_technologies = none
@@ -929,7 +961,7 @@ version = 2
 reference = ["https://attack.mitre.org/wiki/Technique/T1059", "https://www.microsoft.com/en-us/wdsi/threats/macro-malware", "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"]
 detection_searches = ["ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule"]
 mappings = {"cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Exploitation"], "mitre_attack": ["T1036", "T1059", "T1064"], "nist": ["DE.CM", "PR.IP", "PR.PT"]}
-investigative_searches = ["ESCU - Get Parent Process Info", "ESCU - Get Notable History", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Investigate Web Activity From Host", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Registry Activities"]
+investigative_searches = ["ESCU - Get Risk Modifiers For User", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get User Information from Identity Table", "ESCU - Investigate Web Activity From Host", "ESCU - Get Notable History", "ESCU - Get Registry Activities"]
 support_searches = ["ESCU - Baseline of Command Line Length - MLTK", "ESCU - Previously seen command line arguments"]
 data_models = ["Endpoint"]
 providing_technologies = none
@@ -945,7 +977,7 @@ version = 1
 reference = ["http://blogs.splunk.com/2015/10/01/random-words-on-entropy-and-dns/", "http://www.darkreading.com/analytics/security-monitoring/got-malware-three-signs-revealed-in-dns-traffic/d/d-id/1139680", "https://live.paloaltonetworks.com/t5/Threat-Vulnerability-Articles/What-are-suspicious-DNS-queries/ta-p/71454"]
 detection_searches = ["ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Excessive DNS Failures - Rule"]
 mappings = {"cis20": ["CIS 1", "CIS 12", "CIS 13", "CIS 3", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1043", "T1048"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.DS", "PR.IP", "PR.PT"]}
-investigative_searches = ["ESCU - Get DNS Server History for a host", "ESCU - Get Process Responsible For The DNS Traffic", "ESCU - Get Parent Process Info", "ESCU - Get Notable History", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get DNS traffic ratio", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table"]
+investigative_searches = ["ESCU - Get Process Responsible For The DNS Traffic", "ESCU - Get Risk Modifiers For User", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get User Information from Identity Table", "ESCU - Get Notable History", "ESCU - Get DNS traffic ratio", "ESCU - Get DNS Server History for a host"]
 support_searches = ["ESCU - Baseline of DNS Query Length - MLTK"]
 data_models = ["Network_Resolution"]
 providing_technologies = none
@@ -961,7 +993,7 @@ version = 1
 reference = ["https://www.splunk.com/blog/2015/06/26/phishing-hits-a-new-level-of-quality/"]
 detection_searches = ["ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Suspicious Email - UBA Anomaly - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule"]
 mappings = {"cis20": ["CIS 12", "CIS 3", "CIS 7"], "kill_chain_phases": ["Delivery"], "nist": ["DE.AE", "PR.IP"]}
-investigative_searches = ["ESCU - Get Notable History", "ESCU - Get Risk Modifiers For User", "ESCU - Investigate Web Activity From Host", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Emails From Specific Sender", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Email Info", "ESCU - Get User Information from Identity Table"]
+investigative_searches = ["ESCU - Get Emails From Specific Sender", "ESCU - Get Email Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table", "ESCU - Investigate Web Activity From Host", "ESCU - Get Notable History"]
 support_searches = ["ESCU - DNSTwist Domain Names"]
 data_models = ["Email", "UEBA"]
 providing_technologies = none
@@ -981,7 +1013,7 @@ version = 1
 reference = ["https://redcanary.com/blog/windows-registry-attacks-threat-detection/", "https://medium.com/@mbromileyDFIR/malware-monday-aebb456356c5", "https://attack.mitre.org/wiki/Technique/T1170"]
 detection_searches = ["ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Detect mshta exe running scripts in command-line arguments - Rule", "ESCU - Registry Keys Used For Persistence - Rule"]
 mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Exploitation"], "mitre_attack": ["T1059", "T1103", "T1131"], "nist": ["DE.AE", "DE.CM", "PR.PT"]}
-investigative_searches = ["ESCU - Get Parent Process Info", "ESCU - Get Notable History", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Investigate Web Activity From Host", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Registry Activities"]
+investigative_searches = ["ESCU - Get Risk Modifiers For User", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get User Information from Identity Table", "ESCU - Investigate Web Activity From Host", "ESCU - Get Notable History", "ESCU - Get Registry Activities"]
 support_searches = ["ESCU - Baseline of Command Line Length - MLTK", "ESCU - Previously seen command line arguments"]
 data_models = ["Endpoint"]
 providing_technologies = none
@@ -1017,7 +1049,7 @@ version = 2
 reference = ["https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf", "https://www.fireeye.com/blog/threat-research/2017/03/wmimplant_a_wmi_ba.html"]
 detection_searches = ["ESCU - Process Execution via WMI - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Remote WMI Command Attempt - Rule", "ESCU - Script Execution via WMI - Rule", "ESCU - WMI Permanent Event Subscription - Rule", "ESCU - WMI Permanent Event Subscription - Sysmon - Rule", "ESCU - WMI Temporary Event Subscription - Rule"]
 mappings = {"cis20": ["CIS 3", "CIS 5"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1047", "T1084"], "nist": ["PR.AC", "PR.AT", "PR.IP", "PR.PT"]}
-investigative_searches = ["ESCU - Get Sysmon WMI Activity for Host", "ESCU - Get Parent Process Info", "ESCU - Get Notable History", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table"]
+investigative_searches = ["ESCU - Get Risk Modifiers For User", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get User Information from Identity Table", "ESCU - Get Notable History", "ESCU - Get Sysmon WMI Activity for Host"]
 support_searches = []
 data_models = ["Endpoint"]
 providing_technologies = none
@@ -1035,7 +1067,7 @@ version = 1
 reference = ["https://redcanary.com/blog/windows-registry-attacks-threat-detection/", "https://attack.mitre.org/wiki/Technique/T1112"]
 detection_searches = ["ESCU - Disabling Remote User Account Control - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Suspicious Changes to File Associations - Rule"]
 mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1015", "T1042", "T1103", "T1112", "T1131", "T1138"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.IP", "PR.PT"]}
-investigative_searches = ["ESCU - Get Parent Process Info", "ESCU - Get Notable History", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Investigate Web Activity From Host", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Registry Activities"]
+investigative_searches = ["ESCU - Get Risk Modifiers For User", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get User Information from Identity Table", "ESCU - Investigate Web Activity From Host", "ESCU - Get Notable History", "ESCU - Get Registry Activities"]
 support_searches = []
 data_models = ["Endpoint"]
 providing_technologies = none
@@ -1044,6 +1076,23 @@ narrative = Attackers are developing increasingly sophisticated techniques for h
  The registry is a key component of the Windows operating system. It has a hierarchical database called "registry" that contains settings, options, and values for executables. Once the threat actor gains access to a machine, they can use reg.exe to modify their account to obtain administrator-level privileges, maintain persistence, and move laterally within the environment.\
  The searches in this story are designed to help you detect behaviors associated with manipulation of the Windows registry.
 
+[Suspicious Zoom Child Processes]
+category =  Adversary Tactics
+creation_date = 2020-04-13
+modification_date = 2020-04-13
+id = aa3749a6-49c7-491e-a03f-4eaee5fe0258
+version = 1
+reference = ["https://blog.rapid7.com/2020/04/02/dispelling-zoom-bugbears-what-you-need-to-know-about-the-latest-zoom-vulnerabilities/", "https://threatpost.com/two-zoom-zero-day-flaws-uncovered/154337/"]
+detection_searches = ["ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - First Time Seen Child Process of Zoom - Rule"]
+mappings = {"cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Exploitation"], "mitre_attack": ["T1059", "T1068"], "nist": ["DE.CM", "PR.IP", "PR.PT"]}
+investigative_searches = ["ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Process Registry Activity", "ESCU - Get Process File Activity"]
+support_searches = ["ESCU - Previously Seen Zoom Child Processes - Update", "ESCU - Previously Seen Zoom Child Processes - Initial"]
+data_models = ["Endpoint"]
+providing_technologies = none
+description = Attackers are using Zoom as an vector to increase privileges on a sytems. This story detects new child processes of zoom and provides investigative actions for this detection.
+narrative = Zoom is a leader in modern enterprise video communications and its usage has increased dramatically with a large amount of the population under stay-at-home orders due to the COVID-19 pandemic. With increased usage has come increased scrutiny and several security flaws have been found with this application on both Windows and macOS systems.\
+Current detections focus on finding new child processes of this application on a per host basis. Investigative searches are included to gather information needed during an investigation.
+
 [Unusual AWS EC2 Modifications]
 category =  Cloud Security
 creation_date = 2018-04-09
@@ -1053,7 +1102,7 @@ version = 1
 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
 detection_searches = ["ESCU - EC2 Instance Modified With Previously Unseen User - Rule"]
 mappings = {"cis20": ["CIS 1"], "nist": ["ID.AM"]}
-investigative_searches = ["ESCU - AWS Investigate User Activities By ARN", "ESCU - Get Notable History", "ESCU - Get EC2 Instance Details by instanceId"]
+investigative_searches = ["ESCU - AWS Investigate User Activities By ARN", "ESCU - Get EC2 Instance Details by instanceId", "ESCU - Get Notable History"]
 support_searches = ["ESCU - Previously Seen EC2 Modifications By User"]
 data_models = []
 providing_technologies = none
@@ -1070,7 +1119,7 @@ version = 2
 reference = ["https://www.fireeye.com/blog/threat-research/2017/08/monitoring-windows-console-activity-part-two.html", "https://www.splunk.com/pdfs/technical-briefs/advanced-threat-detection-and-response-tech-brief.pdf", "https://www.sans.org/reading-room/whitepapers/logging/detecting-security-incidents-windows-workstation-event-logs-34262"]
 detection_searches = ["ESCU - Detect Rare Executables - Rule", "ESCU - Detect processes used for System Network Configuration Discovery - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule"]
 mappings = {"cis20": ["CIS 2", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Installation"], "mitre_attack": ["T1015", "T1036", "T1085"], "nist": ["DE.CM", "ID.AM", "PR.DS", "PR.PT"]}
-investigative_searches = ["ESCU - Get Parent Process Info", "ESCU - Get Notable History", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Investigate Web Activity From Host", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table"]
+investigative_searches = ["ESCU - Get Risk Modifiers For User", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get User Information from Identity Table", "ESCU - Investigate Web Activity From Host", "ESCU - Get Notable History"]
 support_searches = ["ESCU - Baseline of Command Line Length - MLTK"]
 data_models = ["Endpoint"]
 providing_technologies = none
@@ -1088,7 +1137,7 @@ version = 1
 reference = ["https://www.monkey.org/~dugsong/dsniff/"]
 detection_searches = ["ESCU - Protocols passing authentication in cleartext - Rule"]
 mappings = {"cis20": ["CIS 14"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.DS"]}
-investigative_searches = ["ESCU - Get Notable History", "ESCU - Get Risk Modifiers For User", "ESCU - Get Process Information For Port Activity", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table"]
+investigative_searches = ["ESCU - Get Risk Modifiers For User", "ESCU - Get Process Information For Port Activity", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table", "ESCU - Get Notable History"]
 support_searches = []
 data_models = ["Network_Traffic"]
 providing_technologies = none
@@ -1104,7 +1153,7 @@ version = 1
 reference = ["https://www.fbi.gov/scams-and-safety/common-fraud-schemes/internet-fraud", "https://www.fbi.gov/news/stories/2017-internet-crime-report-released-050718"]
 detection_searches = ["ESCU - Web Fraud - Account Harvesting - Rule", "ESCU - Web Fraud - Anomalous User Clickspeed - Rule", "ESCU - Web Fraud - Password Sharing Across Accounts - Rule"]
 mappings = {"cis20": ["CIS 16", "CIS 6"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078", "T1136"], "nist": ["DE.AE", "DE.CM", "DE.DP"]}
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get Emails From Specific Sender", "ESCU - Get Web Session Information via session id"]
+investigative_searches = ["ESCU - Get Emails From Specific Sender", "ESCU - Get Notable Info", "ESCU - Get Web Session Information via session id", "ESCU - Get Notable History"]
 support_searches = []
 data_models = []
 providing_technologies = none
@@ -1125,7 +1174,7 @@ version = 1
 reference = ["https://attack.mitre.org/wiki/Defense_Evasion"]
 detection_searches = ["ESCU - Disabling Remote User Account Control - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Suspicious Reg exe Process - Rule"]
 mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1089", "T1112"], "nist": ["DE.CM", "PR.PT"]}
-investigative_searches = ["ESCU - Get Parent Process Info", "ESCU - Get Notable History", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Registry Activities"]
+investigative_searches = ["ESCU - Get Risk Modifiers For User", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get User Information from Identity Table", "ESCU - Get Notable History", "ESCU - Get Registry Activities"]
 support_searches = []
 data_models = ["Endpoint"]
 providing_technologies = none
@@ -1141,7 +1190,7 @@ version = 1
 reference = ["https://blog.malwarebytes.com/cybercrime/2013/12/file-extensions-2/", "https://attack.mitre.org/wiki/Technique/T1042"]
 detection_searches = ["ESCU - Execution of File With Spaces Before Extension - Rule", "ESCU - Execution of File with Multiple Extensions - Rule", "ESCU - Suspicious Changes to File Associations - Rule"]
 mappings = {"cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1042"], "nist": ["DE.CM", "PR.IP", "PR.PT"]}
-investigative_searches = ["ESCU - Get Parent Process Info", "ESCU - Get Notable History", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Registry Activities"]
+investigative_searches = ["ESCU - Get Risk Modifiers For User", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get User Information from Identity Table", "ESCU - Get Notable History", "ESCU - Get Registry Activities"]
 support_searches = []
 data_models = ["Endpoint"]
 providing_technologies = none
@@ -1161,7 +1210,7 @@ version = 2
 reference = ["https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/", "https://zeltser.com/security-incident-log-review-checklist/", "http://journeyintoir.blogspot.com/2013/01/re-introducing-usnjrnl.html"]
 detection_searches = ["ESCU - Deleting Shadow Copies - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Windows Event Log Cleared - Rule"]
 mappings = {"cis20": ["CIS 10", "CIS 3", "CIS 5", "CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070"], "nist": ["DE.AE", "DE.CM", "DE.DP", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]}
-investigative_searches = ["ESCU - Get Parent Process Info", "ESCU - Get Notable History", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Investigate Web Activity From Host", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table"]
+investigative_searches = ["ESCU - Get Risk Modifiers For User", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get User Information from Identity Table", "ESCU - Investigate Web Activity From Host", "ESCU - Get Notable History", "ESCU - Get Vulnerability Logs For Endpoint"]
 support_searches = []
 data_models = ["Endpoint"]
 providing_technologies = none
@@ -1178,7 +1227,7 @@ version = 2
 reference = ["http://www.fuzzysecurity.com/tutorials/19.html", "https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html", "http://resources.infosecinstitute.com/common-malware-persistence-mechanisms/", "https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html", "https://www.youtube.com/watch?v=dq2Hv7J9fvk"]
 detection_searches = ["ESCU - Detect Path Interception By Creation Of program exe - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Shim Database File Creation - Rule", "ESCU - Shim Database Installation With Suspicious Parameters - Rule"]
 mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Installation"], "mitre_attack": ["T1031", "T1050", "T1053", "T1089", "T1103", "T1131", "T1138"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]}
-investigative_searches = ["ESCU - Get Parent Process Info", "ESCU - Get Notable History", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Investigate Web Activity From Host", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Registry Activities"]
+investigative_searches = ["ESCU - Get Risk Modifiers For User", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get User Information from Identity Table", "ESCU - Investigate Web Activity From Host", "ESCU - Get Notable History", "ESCU - Get Registry Activities"]
 support_searches = []
 data_models = ["Endpoint"]
 providing_technologies = none
@@ -1194,7 +1243,7 @@ version = 2
 reference = ["https://attack.mitre.org/tactics/TA0004/"]
 detection_searches = ["ESCU - Child Processes of Spoolsv exe - Rule", "ESCU - Overwriting Accessibility Binaries - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Uncommon Processes On Endpoint - Rule"]
 mappings = {"cis20": ["CIS 2", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Exploitation"], "mitre_attack": ["T1015", "T1068"], "nist": ["DE.CM", "ID.AM", "PR.DS", "PR.PT"]}
-investigative_searches = ["ESCU - Get Parent Process Info", "ESCU - Get Notable History", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Investigate Web Activity From Host", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Registry Activities"]
+investigative_searches = ["ESCU - Get Risk Modifiers For User", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get User Information from Identity Table", "ESCU - Investigate Web Activity From Host", "ESCU - Get Notable History", "ESCU - Get Registry Activities"]
 support_searches = []
 data_models = ["Endpoint"]
 providing_technologies = none
@@ -1210,7 +1259,7 @@ version = 3
 reference = ["https://attack.mitre.org/wiki/Technique/T1050", "https://attack.mitre.org/wiki/Technique/T1031"]
 detection_searches = ["ESCU - First Time Seen Running Windows Service - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule"]
 mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Installation"], "mitre_attack": ["T1031", "T1050", "T1089"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]}
-investigative_searches = ["ESCU - Get Parent Process Info", "ESCU - Get Notable History", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table"]
+investigative_searches = ["ESCU - Get Risk Modifiers For User", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get User Information from Identity Table", "ESCU - Get Notable History"]
 support_searches = ["ESCU - Previously Seen Running Windows Services"]
 data_models = ["Endpoint"]
 providing_technologies = none

package/default/app.conf

@@ -4,7 +4,7 @@
 is_configured = false
 state = enabled
 state_change_requires_restart = false
-build = 5208
+build = 5971
 
 [triggers]
 reload.analytic_stories = simple
@@ -20,7 +20,7 @@ reload.content-version = simple
 
 [launcher]
 author = Splunk
-version = 1.0.54
+version = 3.0.1
 description = Explore the Analytic Stories included with ES Content Updates.
 
 [ui]

package/default/collections.conf

@@ -1,13 +1,11 @@
-[kvstore_process_length]
-field.process_name = string
-field.dest = string
-field.length = number
-field.stddev = number
-accelerated_fields.my_acceleration = {"process_name": 1, "dest": 1}
+#############
+# Automatically generated by generator.py in splunk/security-content
+# On Date: 2020-06-04T22:46:46 UTC
+# Author: Splunk Security Research
+# Contact: research@splunk.com
+#############
 
-[kvstore_process_path]
-field.process_name = string
-field.dest = string
-field.process_path = string
-accelerated_fields.my_acceleration = {"process_name": 1, "dest": 1}
+[zoom_first_time_child_process]
+enforceTypes = false
+replicate = false
 

package/default/content-version.conf

@@ -1,2 +1,2 @@
 [content-version]
-version = 1.0.54
+version = 3.0.1

package/default/data/ui/panels/workbench_panel_get_sysmon_wmi_activity_for_host.xml

@@ -1,7 +1,7 @@
 <panel>
   <table>
     <search>
-      <query>sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode>18 EventCode<22 host=$dest$ | rename host as dest | table _time, dest, user, Name, Operation, EventType, Type, Query, Consumer, Filter</query>
+      <query>sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode&gt;18 EventCode&lt;22 host=$dest$ | rename host as dest | table _time, dest, user, Name, Operation, EventType, Type, Query, Consumer, Filter</query>
     </search>
     <option name="drilldown">cell</option>
     <option name="wrap">false</option>

package/default/data/ui/panels/workbench_panel_investigate_aws_ecr_container_listing_activity.xml

@@ -1,7 +1,7 @@
 <panel>
   <table>
     <search>
-      <query>|tstats count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Cloud_Infrastructure.Compute where Compute.user_type!="AssumeRole" AND Compute.event_name="ListImages" by Compute.image_id Compute.src_user Compute.src Compute.http_user_agent Compute.user_type | rename "Compute.*" as * |stats values(http_user_agent) as http_user_agent distinct_count(http_user_agent) as unique_ua_count by src_user, image_id, src, user_type | where unique_ua_count > 1</query>
+      <query>|tstats count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Cloud_Infrastructure.Compute where Compute.user_type!="AssumeRole" AND Compute.event_name="ListImages" by Compute.image_id Compute.src_user Compute.src Compute.http_user_agent Compute.user_type | rename "Compute.*" as * |stats values(http_user_agent) as http_user_agent distinct_count(http_user_agent) as unique_ua_count by src_user, image_id, src, user_type | where unique_ua_count &gt; 1</query>
     </search>
     <option name="drilldown">cell</option>
     <option name="wrap">false</option>

package/default/data/ui/panels/workbench_panel_investigate_failed_logins_for_multiple_destinations.xml

@@ -1,7 +1,7 @@
 <panel>
   <table>
     <search>
-      <query>| tstats count `security_content_summariesonly` earliest(_time) as first_login latest(_time) as last_login dc(Authentication.dest) AS distinct_count_dest values(Authentication.dest) AS Authentication.dest values(Authentication.app) AS Authentication.app  from datamodel=Authentication where Authentication.action=failure by Authentication.user | where distinct_count_dest > 1 | `security_content_ctime(first_login)` | `security_content_ctime(last_login)` | `drop_dm_object_name("Authentication")`</query>
+      <query>| tstats count `security_content_summariesonly` earliest(_time) as first_login latest(_time) as last_login dc(Authentication.dest) AS distinct_count_dest values(Authentication.dest) AS Authentication.dest values(Authentication.app) AS Authentication.app  from datamodel=Authentication where Authentication.action=failure by Authentication.user | where distinct_count_dest &gt; 1 | `security_content_ctime(first_login)` | `security_content_ctime(last_login)` | `drop_dm_object_name("Authentication")`</query>
     </search>
     <option name="drilldown">cell</option>
     <option name="wrap">false</option>

package/default/data/ui/panels/workbench_panel_investigate_pass_the_ticket_attempts.xml

@@ -1,7 +1,7 @@
 <panel>
   <table>
     <search>
-      <query>`wineventlog_security` EventCode=4768 OR EventCode=4769 | rex field=user "(?<new_user>[^\@]+)" | stats count BY new_user, dest, EventCode | stats max(count) AS max_count sum(count) AS sum_count BY new_user, dest | where sum_count/max_count!=2 | rename new_user AS user</query>
+      <query>`wineventlog_security` EventCode=4768 OR EventCode=4769 | rex field=user "(?&lt;new_user&gt;[^\@]+)" | stats count BY new_user, dest, EventCode | stats max(count) AS max_count sum(count) AS sum_count BY new_user, dest | where sum_count/max_count!=2 | rename new_user AS user</query>
     </search>
     <option name="drilldown">cell</option>
     <option name="wrap">false</option>

package/default/data/ui/panels/workbench_panel_investigate_previous_unseen_user.xml

@@ -1,7 +1,7 @@
 <panel>
   <table>
     <search>
-      <query>| tstats count `security_content_summariesonly` earliest(_time) as first_login latest(_time) as last_login values(Authentication.dest) AS Authentication.dest values(Authentication.app) AS Authentication.app values(Authentication.action) AS Authentication.action from datamodel=Authentication where Authentication.action=success by _time, Authentication.user | bucket _time span=30d | stats count min(first_login) as first_login max(last_login) as last_login values(Authentication.dest) AS Authentication.dest by Authentication.user | where count=1 | where first_login >= relative_time(now(), "-30d") | `security_content_ctime(first_login)` | `security_content_ctime(last_login)` | `drop_dm_object_name("Authentication")`</query>
+      <query>| tstats count `security_content_summariesonly` earliest(_time) as first_login latest(_time) as last_login values(Authentication.dest) AS Authentication.dest values(Authentication.app) AS Authentication.app values(Authentication.action) AS Authentication.action from datamodel=Authentication where Authentication.action=success by _time, Authentication.user | bucket _time span=30d | stats count min(first_login) as first_login max(last_login) as last_login values(Authentication.dest) AS Authentication.dest by Authentication.user | where count=1 | where first_login &gt;= relative_time(now(), "-30d") | `security_content_ctime(first_login)` | `security_content_ctime(last_login)` | `drop_dm_object_name("Authentication")`</query>
     </search>
     <option name="drilldown">cell</option>
     <option name="wrap">false</option>

package/default/data/ui/panels/workbench_panel_investigate_suspicious_strings_in_http_header.xml

@@ -1,7 +1,7 @@
 <panel>
   <table>
     <search>
-      <query>| search sourcetype=stream:http src_ip="$src_ip$" dest_ip="$dest_ip$" | eval cs_content_type_length = len(cs_content_type) | search cs_content_type_length > 100 | rex field="cs_content_type" (?<suspicious_strings>cmd.exe) | eval suspicious_strings_found=if(match(cs_content_type, "application"), "True", "False")  | rename suspicious_strings_found AS "Suspicious Content-Type Found" | fields "Suspicious Content-Type Found", dest_ip, src_ip, suspicious_strings, cs_content_type, cs_content_type_length, url</query>
+      <query>| search sourcetype=stream:http src_ip="$src_ip$" dest_ip="$dest_ip$" | eval cs_content_type_length = len(cs_content_type) | search cs_content_type_length &gt; 100 | rex field="cs_content_type" (?&lt;suspicious_strings&gt;cmd.exe) | eval suspicious_strings_found=if(match(cs_content_type, "application"), "True", "False")  | rename suspicious_strings_found AS "Suspicious Content-Type Found" | fields "Suspicious Content-Type Found", dest_ip, src_ip, suspicious_strings, cs_content_type, cs_content_type_length, url</query>
     </search>
     <option name="drilldown">cell</option>
     <option name="wrap">false</option>

package/default/es_investigations.conf

@@ -3,79 +3,79 @@
 label = AWS Cross Account Activity
 description = Track when a user assumes an IAM role in another AWS account to obtain cross-account access to services and resources in that account. Accessing new roles could be an indication of malicious activity.
 disabled = 0
-panels = ["panel://workbench_panel_aws_investigate_user_activities_by_source_user", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_aws_investigate_user_activities_by_accesskeyid"]
+panels = ["panel://workbench_panel_get_notable_history", "panel://workbench_panel_aws_investigate_user_activities_by_accesskeyid", "panel://workbench_panel_aws_investigate_user_activities_by_source_user"]
 
 [panel_group://workbench_panel_group_aws_cryptomining]
 label = AWS Cryptomining
 description = Monitor your AWS EC2 instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or EC2 instances started by previously unseen users are just a few examples of potentially malicious behavior.
 disabled = 0
-panels = ["panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_aws_investigate_user_activities_by_arn", "panel://workbench_panel_investigate_aws_activities_via_region_name", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_ec2_instance_details_by_instanceid", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_ec2_launch_details"]
+panels = ["panel://workbench_panel_get_ec2_instance_details_by_instanceid", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_ec2_launch_details", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_investigate_aws_activities_via_region_name", "panel://workbench_panel_aws_investigate_user_activities_by_arn"]
 
 [panel_group://workbench_panel_group_aws_network_acl_activity]
 label = AWS Network ACL Activity
 description = Monitor your AWS network infrastructure for bad configurations and malicious activity. Investigative searches help you probe deeper, when the facts warrant it.
 disabled = 0
-panels = ["panel://workbench_panel_aws_network_acl_details_from_id", "panel://workbench_panel_get_dns_server_history_for_a_host", "panel://workbench_panel_aws_investigate_user_activities_by_arn", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_all_aws_activity_from_ip_address", "panel://workbench_panel_get_dns_traffic_ratio", "panel://workbench_panel_get_process_information_for_port_activity", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_aws_network_interface_details_via_resourceid", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table"]
+panels = ["panel://workbench_panel_get_process_responsible_for_the_dns_traffic", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_process_information_for_port_activity", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_aws_network_interface_details_via_resourceid", "panel://workbench_panel_aws_network_acl_details_from_id", "panel://workbench_panel_get_all_aws_activity_from_ip_address", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_dns_traffic_ratio", "panel://workbench_panel_get_dns_server_history_for_a_host", "panel://workbench_panel_aws_investigate_user_activities_by_arn"]
 
 [panel_group://workbench_panel_group_aws_suspicious_provisioning_activities]
 label = AWS Suspicious Provisioning Activities
 description = Monitor your AWS provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your network.
 disabled = 0
-panels = ["panel://workbench_panel_get_all_aws_activity_from_ip_address", "panel://workbench_panel_get_all_aws_activity_from_region", "panel://workbench_panel_get_all_aws_activity_from_country", "panel://workbench_panel_get_all_aws_activity_from_city"]
+panels = ["panel://workbench_panel_get_all_aws_activity_from_country", "panel://workbench_panel_get_all_aws_activity_from_city", "panel://workbench_panel_get_all_aws_activity_from_region", "panel://workbench_panel_get_all_aws_activity_from_ip_address"]
 
 [panel_group://workbench_panel_group_aws_user_monitoring]
 label = AWS User Monitoring
 description = Detect and investigate dormant user accounts for your AWS environment that have become active again. Because inactive and ad-hoc accounts are common attack targets, it's critical to enable governance within your environment.
 disabled = 0
-panels = ["panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_investigate_aws_user_activities_by_user_field"]
+panels = ["panel://workbench_panel_investigate_aws_user_activities_by_user_field", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_notable_info"]
 
 [panel_group://workbench_panel_group_account_monitoring_and_controls]
 label = Account Monitoring and Controls
 description = A common attack technique is to leverage user accounts to gain unauthorized access to the target's network. This Analytic Story minimizes opportunities for attack by helping you actively manage creation/use/dormancy/deletion--the lifecycle of system and application accounts.
 disabled = 0
-panels = ["panel://workbench_panel_get_logon_rights_modifications_for_endpoint", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_logon_rights_modifications_for_user", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table"]
+panels = ["panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_logon_rights_modifications_for_user", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_logon_rights_modifications_for_endpoint"]
 
 [panel_group://workbench_panel_group_apache_struts_vulnerability]
 label = Apache Struts Vulnerability
 description = Detect and investigate activities--such as unusually long `Content-Type` length, suspicious java classes and web servers executing suspicious processes--consistent with attempts to exploit Apache Struts vulnerabilities.
 disabled = 0
-panels = ["panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_investigate_suspicious_strings_in_http_header", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_investigate_web_posts_from_src", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table"]
+panels = ["panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_investigate_suspicious_strings_in_http_header", "panel://workbench_panel_investigate_web_posts_from_src", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_notable_history"]
 
 [panel_group://workbench_panel_group_asset_tracking]
 label = Asset Tracking
 description = Keep a careful inventory of every asset on your network to make it easier to detect rogue devices. Unauthorized/unmanaged devices could be an indication of malicious behavior that should be investigated further.
 disabled = 0
-panels = ["panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_first_occurrence_and_last_occurrence_of_a_mac_address"]
+panels = ["panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_first_occurrence_and_last_occurrence_of_a_mac_address"]
 
 [panel_group://workbench_panel_group_brand_monitoring]
 label = Brand Monitoring
 description = Detect and investigate activity that may indicate that an adversary is using faux domains to mislead users into interacting with malicious infrastructure. Monitor DNS, email, and web traffic for permutations of your brand name.
 disabled = 0
-panels = ["panel://workbench_panel_get_process_responsible_for_the_dns_traffic", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_emails_from_specific_sender", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_email_info", "panel://workbench_panel_get_user_information_from_identity_table"]
+panels = ["panel://workbench_panel_get_process_responsible_for_the_dns_traffic", "panel://workbench_panel_get_emails_from_specific_sender", "panel://workbench_panel_get_email_info", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_notable_history"]
 
 [panel_group://workbench_panel_group_cloud_cryptomining]
 label = Cloud Cryptomining
 description = Monitor your cloud compute instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or compute instances started by previously unseen users are just a few examples of potentially malicious behavior.
 disabled = 0
-panels = ["panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_aws_investigate_user_activities_by_arn", "panel://workbench_panel_investigate_aws_activities_via_region_name", "panel://workbench_panel_investigate_user_activities_in_single_cloud_region", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_investigate_user_activities_in_all_cloud_regions", "panel://workbench_panel_get_ec2_instance_details_by_instanceid", "panel://workbench_panel_investigate_cloud_compute_instance_activities", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_ec2_launch_details"]
+panels = ["panel://workbench_panel_get_ec2_instance_details_by_instanceid", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_ec2_launch_details", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_investigate_cloud_compute_instance_activities", "panel://workbench_panel_investigate_aws_activities_via_region_name", "panel://workbench_panel_aws_investigate_user_activities_by_arn", "panel://workbench_panel_investigate_user_activities_in_all_cloud_regions", "panel://workbench_panel_investigate_user_activities_in_single_cloud_region"]
 
 [panel_group://workbench_panel_group_coldroot_macos_rat]
 label = ColdRoot MacOS RAT
 description = Leverage searches that allow you to detect and investigate unusual activities that relate to the ColdRoot Remote Access Trojan that affects MacOS. An example of some of these activities are changing sensative binaries in the MacOS sub-system, detecting process names and executables associated with the RAT, detecting when a keyboard tab is installed on a MacOS machine and more.
 disabled = 0
-panels = ["panel://workbench_panel_investigate_network_traffic_from_src_ip", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_investigate_web_activity_from_src_ip", "panel://workbench_panel_get_vulnerability_logs_for_endpoint", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table"]
+panels = ["panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_investigate_network_traffic_from_src_ip", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_vulnerability_logs_for_endpoint", "panel://workbench_panel_investigate_web_activity_from_src_ip"]
 
 [panel_group://workbench_panel_group_collection_and_staging]
 label = Collection and Staging
 description = Monitor for and investigate activities--such as suspicious writes to the Windows Recycling Bin or email servers sending high amounts of traffic to specific hosts, for example--that may indicate that an adversary is harvesting and exfiltrating sensitive data. 
 disabled = 0
-panels = ["panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table"]
+panels = ["panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_notable_history"]
 
 [panel_group://workbench_panel_group_command_and_control]
 label = Command and Control
 description = Detect and investigate tactics, techniques, and procedures leveraged by attackers to establish and operate command and control channels. Implants installed by attackers on compromised endpoints use these channels to receive instructions and send data back to the malicious operators.
 disabled = 0
-panels = ["panel://workbench_panel_aws_network_acl_details_from_id", "panel://workbench_panel_get_dns_server_history_for_a_host", "panel://workbench_panel_aws_investigate_user_activities_by_arn", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic", "panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_all_aws_activity_from_ip_address", "panel://workbench_panel_get_dns_traffic_ratio", "panel://workbench_panel_get_process_information_for_port_activity", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_aws_network_interface_details_via_resourceid", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table"]
+panels = ["panel://workbench_panel_get_process_responsible_for_the_dns_traffic", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_process_information_for_port_activity", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_aws_network_interface_details_via_resourceid", "panel://workbench_panel_aws_network_acl_details_from_id", "panel://workbench_panel_get_all_aws_activity_from_ip_address", "panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_dns_traffic_ratio", "panel://workbench_panel_get_dns_server_history_for_a_host", "panel://workbench_panel_aws_investigate_user_activities_by_arn"]
 
 [panel_group://workbench_panel_group_common_phishing_frameworks]
 label = Common Phishing Frameworks
@@ -93,19 +93,19 @@ panels = ["panel://workbench_panel_investigate_aws_ecr_container_listing_activit
 label = Credential Dumping
 description = Uncover activity consistent with credential dumping, a technique wherein attackers compromise systems and attempt to obtain and exfiltrate passwords. The threat actors use these pilfered credentials to further escalate privileges and spread throughout a target environment. The included searches in this Analytic Story are designed to identify attempts to credential dumping.
 disabled = 0
-panels = ["panel://workbench_panel_investigate_failed_logins_for_multiple_destinations", "panel://workbench_panel_investigate_previous_unseen_user", "panel://workbench_panel_investigate_pass_the_hash_attempts", "panel://workbench_panel_investigate_pass_the_ticket_attempts"]
+panels = ["panel://workbench_panel_investigate_pass_the_hash_attempts", "panel://workbench_panel_investigate_previous_unseen_user", "panel://workbench_panel_investigate_pass_the_ticket_attempts", "panel://workbench_panel_investigate_failed_logins_for_multiple_destinations"]
 
 [panel_group://workbench_panel_group_dhs_report_ta18_074a]
 label = DHS Report TA18-074A
 description = Monitor for suspicious activities associated with DHS Technical Alert US-CERT TA18-074A. Some of the activities that adversaries used in these compromises included spearfishing attacks, malware, watering-hole domains, many and more.
 disabled = 0
-panels = ["panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_process_information_for_port_activity", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_process_registry_activity", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_vulnerability_logs_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_process_file_activity", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_registry_activities"]
+panels = ["panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_process_information_for_port_activity", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_process_registry_activity", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_registry_activities", "panel://workbench_panel_get_vulnerability_logs_for_endpoint", "panel://workbench_panel_get_process_file_activity"]
 
 [panel_group://workbench_panel_group_dns_amplification_attacks]
 label = DNS Amplification Attacks
 description = DNS poses a serious threat as a Denial of Service (DOS) amplifier, if it responds to `ANY` queries. This Analytic Story can help you detect attackers who may be abusing your company's DNS infrastructure to launch amplification attacks, causing Denial of Service to other victims.
 disabled = 0
-panels = ["panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_risk_modifiers_for_endpoint"]
+panels = ["panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_risk_modifiers_for_endpoint"]
 
 [panel_group://workbench_panel_group_dns_hijacking]
 label = DNS Hijacking
@@ -117,91 +117,103 @@ panels = ["panel://workbench_panel_get_dns_server_history_for_a_host"]
 label = Data Protection
 description = Fortify your data-protection arsenal--while continuing to ensure data confidentiality and integrity--with searches that monitor for and help you investigate possible signs of data exfiltration.
 disabled = 0
-panels = ["panel://workbench_panel_get_dns_server_history_for_a_host", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_dns_traffic_ratio", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table"]
+panels = ["panel://workbench_panel_get_process_responsible_for_the_dns_traffic", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_dns_traffic_ratio", "panel://workbench_panel_get_dns_server_history_for_a_host"]
 
 [panel_group://workbench_panel_group_disabling_security_tools]
 label = Disabling Security Tools
 description = Looks for activities and techniques associated with the disabling of security tools on a Windows system, such as suspicious `reg.exe` processes, processes launching netsh, and many others.
 disabled = 0
-panels = ["panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table"]
+panels = ["panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_notable_history"]
 
 [panel_group://workbench_panel_group_dynamic_dns]
 label = Dynamic DNS
 description = Detect and investigate hosts in your environment that may be communicating with dynamic domain providers. Attackers may leverage these services to help them avoid firewall blocks and blacklists.
 disabled = 0
-panels = ["panel://workbench_panel_get_dns_server_history_for_a_host", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_dns_traffic_ratio", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_investigate_web_activity_from_src_ip", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table"]
+panels = ["panel://workbench_panel_get_process_responsible_for_the_dns_traffic", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_dns_traffic_ratio", "panel://workbench_panel_get_dns_server_history_for_a_host", "panel://workbench_panel_investigate_web_activity_from_src_ip"]
 
 [panel_group://workbench_panel_group_emotet_malware__dhs_report_ta18_201a_]
 label = Emotet Malware  DHS Report TA18-201A 
 description = Detect rarely used executables, specific registry paths that may confer malware survivability and persistence, instances where cmd.exe is used to launch script interpreters, and other indicators that the Emotet financial malware has compromised your environment.
 disabled = 0
-panels = ["panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_update_logs_for_endpoint", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_process_information_for_port_activity", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_vulnerability_logs_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_registry_activities"]
+panels = ["panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_process_information_for_port_activity", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_update_logs_for_endpoint", "panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_registry_activities", "panel://workbench_panel_get_vulnerability_logs_for_endpoint"]
 
 [panel_group://workbench_panel_group_hidden_cobra_malware]
 label = Hidden Cobra Malware
 description = Monitor for and investigate activities, including the creation or deletion of hidden shares and file writes, that may be evidence of infiltration by North Korean government-sponsored cybercriminals. Details of this activity were reported in DHS Report TA-18-149A.
 disabled = 0
-panels = ["panel://workbench_panel_get_dns_server_history_for_a_host", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic", "panel://workbench_panel_investigate_successful_remote_desktop_authentications", "panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_dns_traffic_ratio", "panel://workbench_panel_get_process_information_for_port_activity", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_vulnerability_logs_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table"]
+panels = ["panel://workbench_panel_get_process_responsible_for_the_dns_traffic", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_process_information_for_port_activity", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_vulnerability_logs_for_endpoint", "panel://workbench_panel_get_dns_traffic_ratio", "panel://workbench_panel_get_dns_server_history_for_a_host", "panel://workbench_panel_investigate_successful_remote_desktop_authentications"]
 
 [panel_group://workbench_panel_group_host_redirection]
 label = Host Redirection
 description = Detect evidence of tactics used to redirect traffic from a host to a destination other than the one intended--potentially one that is part of an adversary's attack infrastructure. An example is redirecting communications regarding patches and updates or misleading users into visiting a malicious website.
 disabled = 0
-panels = ["panel://workbench_panel_get_dns_server_history_for_a_host", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table"]
+panels = ["panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_dns_server_history_for_a_host"]
 
 [panel_group://workbench_panel_group_jboss_vulnerability]
 label = JBoss Vulnerability
 description = In March of 2016, adversaries were seen using JexBoss--an open-source utility used for testing and exploiting JBoss application servers. These searches help detect evidence of these attacks, such as network connections to external resources or web services spawning atypical child processes, among others.
 disabled = 0
-panels = ["panel://workbench_panel_get_notable_history", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_vulnerability_logs_for_endpoint", "panel://workbench_panel_get_notable_info"]
+panels = ["panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_vulnerability_logs_for_endpoint"]
 
 [panel_group://workbench_panel_group_kubernetes_scanning_activity]
 label = Kubernetes Scanning Activity
 description = This story addresses detection against Kubernetes cluster fingerprint scan and attack by providing information on items such as source ip, user agent, cluster names.
 disabled = 0
-panels = ["panel://workbench_panel_gcp_kubernetes_activity_by_src_ip", "panel://workbench_panel_amazon_eks_kubernetes_activity_by_src_ip", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_notable_info"]
+panels = ["panel://workbench_panel_amazon_eks_kubernetes_activity_by_src_ip", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_gcp_kubernetes_activity_by_src_ip"]
+
+[panel_group://workbench_panel_group_kubernetes_sensitive_object_access_activity]
+label = Kubernetes Sensitive Object Access Activity
+description = This story addresses detection and response of accounts acccesing Kubernetes cluster sensitive objects such as configmaps or secrets providing information on items such as user user, group. object, namespace and authorization reason.
+disabled = 0
+panels = ["panel://workbench_panel_get_notable_info"]
+
+[panel_group://workbench_panel_group_kubernetes_sensitive_role_activity]
+label = Kubernetes Sensitive Role Activity
+description = This story addresses detection and response around Sensitive Role usage within a Kubernetes clusters against cluster resources and namespaces.
+disabled = 0
+panels = ["panel://workbench_panel_get_notable_info"]
 
 [panel_group://workbench_panel_group_lateral_movement]
 label = Lateral Movement
 description = Detect and investigate tactics, techniques, and procedures around how attackers move laterally within the enterprise. Because lateral movement can expose the adversary to detection, it should be an important focus for security analysts.
 disabled = 0
-panels = ["panel://workbench_panel_investigate_successful_remote_desktop_authentications", "panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_process_information_for_port_activity", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table"]
+panels = ["panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_process_information_for_port_activity", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_investigate_successful_remote_desktop_authentications"]
 
 [panel_group://workbench_panel_group_malicious_powershell]
 label = Malicious PowerShell
 description = Attackers are finding stealthy ways "live off the land," leveraging utilities and tools that come standard on the endpoint--such as PowerShell--to achieve their goals without downloading binary files. These searches can help you detect and investigate PowerShell command-line options that may be indicative of malicious intent.
 disabled = 0
-panels = ["panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table"]
+panels = ["panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_notable_history"]
 
 [panel_group://workbench_panel_group_monitor_backup_solution]
 label = Monitor Backup Solution
 description = Address common concerns when monitoring your backup processes. These searches can help you reduce risks from ransomware, device theft, or denial of physical access to a host by backing up data on endpoints.
 disabled = 0
-panels = ["panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_all_backup_logs_for_host"]
+panels = ["panel://workbench_panel_all_backup_logs_for_host", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_risk_modifiers_for_endpoint"]
 
 [panel_group://workbench_panel_group_monitor_for_unauthorized_software]
 label = Monitor for Unauthorized Software
 description = Identify and investigate prohibited/unauthorized software or processes that may be concealing malicious behavior within your environment. 
 disabled = 0
-panels = ["panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_update_logs_for_endpoint", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_vulnerability_logs_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table"]
+panels = ["panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_update_logs_for_endpoint", "panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_vulnerability_logs_for_endpoint"]
 
 [panel_group://workbench_panel_group_monitor_for_updates]
 label = Monitor for Updates
 description = Monitor your enterprise to ensure that your endpoints are being patched and updated. Adversaries notoriously exploit known vulnerabilities that could be mitigated by applying routine security patches.
 disabled = 0
-panels = ["panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_risk_modifiers_for_endpoint"]
+panels = ["panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_risk_modifiers_for_endpoint"]
 
 [panel_group://workbench_panel_group_netsh_abuse]
 label = Netsh Abuse
 description = Detect activities and various techniques associated with the abuse of `netsh.exe`, which can disable local firewall settings or set up a remote connection to a host from an infected system.
 disabled = 0
-panels = ["panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table"]
+panels = ["panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_notable_history"]
 
 [panel_group://workbench_panel_group_orangeworm_attack_group]
 label = Orangeworm Attack Group
 description = Detect activities and various techniques associated with the Orangeworm Attack Group, a group that frequently targets the healthcare industry.
 disabled = 0
-panels = ["panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table"]
+panels = ["panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_notable_history"]
 
 [panel_group://workbench_panel_group_phishing_payloads]
 label = Phishing Payloads
@@ -213,61 +225,61 @@ panels = ["panel://workbench_panel_get_parent_process_info"]
 label = Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns
 description = Monitor your environment for suspicious behaviors that resemble the techniques employed by the MUDCARP threat group.
 disabled = 0
-panels = ["panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_registry_activities"]
+panels = ["panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_registry_activities"]
 
 [panel_group://workbench_panel_group_prohibited_traffic_allowed_or_protocol_mismatch]
 label = Prohibited Traffic Allowed or Protocol Mismatch
 description = Detect instances of prohibited network traffic allowed in the environment, as well as protocols running on non-standard ports. Both of these types of behaviors typically violate policy and can be leveraged by attackers.
 disabled = 0
-panels = ["panel://workbench_panel_get_dns_server_history_for_a_host", "panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_process_information_for_port_activity", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table"]
+panels = ["panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_process_information_for_port_activity", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_dns_server_history_for_a_host"]
 
 [panel_group://workbench_panel_group_ransomware]
 label = Ransomware
 description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware--spikes in SMB traffic, suspicious wevtutil usage, the presence of common ransomware extensions, and system processes run from unexpected locations, and many others.
 disabled = 0
-panels = ["panel://workbench_panel_get_sysmon_wmi_activity_for_host", "panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_update_logs_for_endpoint", "panel://workbench_panel_get_backup_logs_for_endpoint", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_process_information_for_port_activity", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_vulnerability_logs_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_registry_activities"]
+panels = ["panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_process_information_for_port_activity", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_update_logs_for_endpoint", "panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_backup_logs_for_endpoint", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_registry_activities", "panel://workbench_panel_get_vulnerability_logs_for_endpoint", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_sysmon_wmi_activity_for_host"]
 
 [panel_group://workbench_panel_group_router_and_infrastructure_security]
 label = Router and Infrastructure Security
 description = Validate the security configuration of network infrastructure and verify that only authorized users and systems are accessing critical assets. Core routing and switching infrastructure are common strategic targets for attackers.
 disabled = 0
-panels = ["panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table"]
+panels = ["panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_notable_history"]
 
 [panel_group://workbench_panel_group_sql_injection]
 label = SQL Injection
 description = Use the searches in this Analytic Story to help you detect structured query language (SQL) injection attempts characterized by long URLs that contain malicious parameters.
 disabled = 0
-panels = ["panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_risk_modifiers_for_endpoint"]
+panels = ["panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_risk_modifiers_for_endpoint"]
 
 [panel_group://workbench_panel_group_samsam_ransomware]
 label = SamSam Ransomware
 description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the SamSam ransomware, including looking for file writes associated with SamSam, RDP brute force attacks, the presence of files with SamSam ransomware extensions, suspicious psexec use, and more.
 disabled = 0
-panels = ["panel://workbench_panel_investigate_successful_remote_desktop_authentications", "panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_update_logs_for_endpoint", "panel://workbench_panel_get_backup_logs_for_endpoint", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_process_information_for_port_activity", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_vulnerability_logs_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table"]
+panels = ["panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_process_information_for_port_activity", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_update_logs_for_endpoint", "panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_backup_logs_for_endpoint", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_vulnerability_logs_for_endpoint", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_investigate_successful_remote_desktop_authentications"]
 
 [panel_group://workbench_panel_group_spectre_and_meltdown_vulnerabilities]
 label = Spectre And Meltdown Vulnerabilities
 description = Assess and mitigate your systems' vulnerability to Spectre and Meltdown exploitation with the searches in this Analytic Story.
 disabled = 0
-panels = ["panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table"]
+panels = ["panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_notable_history"]
 
 [panel_group://workbench_panel_group_splunk_enterprise_vulnerability]
 label = Splunk Enterprise Vulnerability
 description = Keeping your Splunk deployment up to date is critical and may help you reduce the risk of CVE-2016-4859, an open-redirection vulnerability within some older versions of Splunk Enterprise. The detection search will help ensure that users are being properly authenticated and not being redirected to malicious domains.
 disabled = 0
-panels = ["panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_risk_modifiers_for_endpoint"]
+panels = ["panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_risk_modifiers_for_endpoint"]
 
 [panel_group://workbench_panel_group_splunk_enterprise_vulnerability_cve_2018_11409]
 label = Splunk Enterprise Vulnerability CVE-2018-11409
 description = Reduce the risk of CVE-2018-11409, an information disclosure vulnerability within some older versions of Splunk Enterprise, with searches designed to help ensure that your Splunk system does not leak information to authenticated users.
 disabled = 0
-panels = ["panel://workbench_panel_investigate_network_traffic_from_src_ip", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_investigate_web_activity_from_src_ip", "panel://workbench_panel_get_notable_info"]
+panels = ["panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_investigate_network_traffic_from_src_ip", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_investigate_web_activity_from_src_ip"]
 
 [panel_group://workbench_panel_group_suspicious_aws_ec2_activities]
 label = Suspicious AWS EC2 Activities
 description = Use the searches in this Analytic Story to monitor your AWS EC2 instances for evidence of anomalous activity and suspicious behaviors, such as EC2 instances that originate from unusual locations or those launched by previously unseen users (among others). Included investigative searches will help you probe more deeply, when the information warrants it.
 disabled = 0
-panels = ["panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_aws_investigate_user_activities_by_arn", "panel://workbench_panel_investigate_aws_activities_via_region_name", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_ec2_instance_details_by_instanceid", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_ec2_launch_details"]
+panels = ["panel://workbench_panel_get_ec2_instance_details_by_instanceid", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_ec2_launch_details", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_investigate_aws_activities_via_region_name", "panel://workbench_panel_aws_investigate_user_activities_by_arn"]
 
 [panel_group://workbench_panel_group_suspicious_aws_login_activities]
 label = Suspicious AWS Login Activities
@@ -279,37 +291,37 @@ panels = ["panel://workbench_panel_aws_investigate_user_activities_by_arn"]
 label = Suspicious AWS S3 Activities
 description = Use the searches in this Analytic Story to monitor your AWS S3 buckets for evidence of anomalous activity and suspicious behaviors, such as detecting open S3 buckets and buckets being accessed from a new IP. The contextual and investigative searches will give you more information, when required.
 disabled = 0
-panels = ["panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_aws_investigate_user_activities_by_arn", "panel://workbench_panel_investigate_aws_activities_via_region_name", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_all_aws_activity_from_ip_address", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_aws_s3_bucket_details_via_bucketname"]
+panels = ["panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_all_aws_activity_from_ip_address", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_investigate_aws_activities_via_region_name", "panel://workbench_panel_aws_investigate_user_activities_by_arn", "panel://workbench_panel_aws_s3_bucket_details_via_bucketname"]
 
 [panel_group://workbench_panel_group_suspicious_aws_traffic]
 label = Suspicious AWS Traffic
 description = Leverage these searches to monitor your AWS network traffic for evidence of anomalous activity and suspicious behaviors, such as a spike in blocked outbound traffic in your virtual private cloud (VPC).
 disabled = 0
-panels = ["panel://workbench_panel_aws_network_acl_details_from_id", "panel://workbench_panel_get_dns_server_history_for_a_host", "panel://workbench_panel_aws_investigate_user_activities_by_arn", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_all_aws_activity_from_ip_address", "panel://workbench_panel_get_dns_traffic_ratio", "panel://workbench_panel_get_process_information_for_port_activity", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_aws_network_interface_details_via_resourceid", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table"]
+panels = ["panel://workbench_panel_get_process_responsible_for_the_dns_traffic", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_process_information_for_port_activity", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_aws_network_interface_details_via_resourceid", "panel://workbench_panel_aws_network_acl_details_from_id", "panel://workbench_panel_get_all_aws_activity_from_ip_address", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_dns_traffic_ratio", "panel://workbench_panel_get_dns_server_history_for_a_host", "panel://workbench_panel_aws_investigate_user_activities_by_arn"]
 
 [panel_group://workbench_panel_group_suspicious_command_line_executions]
 label = Suspicious Command-Line Executions
 description = Leveraging the Windows command-line interface (CLI) is one of the most common attack techniques--one that is also detailed in the MITRE ATT&CK framework. Use this Analytic Story to help you identify unusual or suspicious use of the CLI on Windows systems.
 disabled = 0
-panels = ["panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_registry_activities"]
+panels = ["panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_registry_activities"]
 
 [panel_group://workbench_panel_group_suspicious_dns_traffic]
 label = Suspicious DNS Traffic
 description = Attackers often attempt to hide within or otherwise abuse the domain name system (DNS). You can thwart attempts to manipulate this omnipresent protocol by monitoring for these types of abuses.
 disabled = 0
-panels = ["panel://workbench_panel_get_dns_server_history_for_a_host", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic", "panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_dns_traffic_ratio", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table"]
+panels = ["panel://workbench_panel_get_process_responsible_for_the_dns_traffic", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_dns_traffic_ratio", "panel://workbench_panel_get_dns_server_history_for_a_host"]
 
 [panel_group://workbench_panel_group_suspicious_emails]
 label = Suspicious Emails
 description = Email remains one of the primary means for attackers to gain an initial foothold within the modern enterprise. Detect and investigate suspicious emails in your environment with the help of the searches in this Analytic Story.
 disabled = 0
-panels = ["panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_emails_from_specific_sender", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_email_info", "panel://workbench_panel_get_user_information_from_identity_table"]
+panels = ["panel://workbench_panel_get_emails_from_specific_sender", "panel://workbench_panel_get_email_info", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_notable_history"]
 
 [panel_group://workbench_panel_group_suspicious_mshta_activity]
 label = Suspicious MSHTA Activity
 description = Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code.
 disabled = 0
-panels = ["panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_registry_activities"]
+panels = ["panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_registry_activities"]
 
 [panel_group://workbench_panel_group_suspicious_okta_activity]
 label = Suspicious Okta Activity
@@ -321,73 +333,79 @@ panels = ["panel://workbench_panel_investigate_user_activities_in_okta", "panel:
 label = Suspicious WMI Use
 description = Attackers are increasingly abusing Windows Management Instrumentation (WMI), a framework and associated utilities available on all modern Windows operating systems. Because WMI can be leveraged to manage both local and remote systems, it is important to identify the processes executed and the user context within which the activity occurred.
 disabled = 0
-panels = ["panel://workbench_panel_get_sysmon_wmi_activity_for_host", "panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table"]
+panels = ["panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_sysmon_wmi_activity_for_host"]
 
 [panel_group://workbench_panel_group_suspicious_windows_registry_activities]
 label = Suspicious Windows Registry Activities
 description = Monitor and detect registry changes initiated from remote locations, which can be a sign that an attacker has infiltrated your system.
 disabled = 0
-panels = ["panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_registry_activities"]
+panels = ["panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_registry_activities"]
+
+[panel_group://workbench_panel_group_suspicious_zoom_child_processes]
+label = Suspicious Zoom Child Processes
+description = Attackers are using Zoom as an vector to increase privileges on a sytems. This story detects new child processes of zoom and provides investigative actions for this detection.
+disabled = 0
+panels = ["panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_process_registry_activity", "panel://workbench_panel_get_process_file_activity"]
 
 [panel_group://workbench_panel_group_unusual_aws_ec2_modifications]
 label = Unusual AWS EC2 Modifications
 description = Identify unusual changes to your AWS EC2 instances that may indicate malicious activity. Modifications to your EC2 instances by previously unseen users is an example of an activity that may warrant further investigation.
 disabled = 0
-panels = ["panel://workbench_panel_aws_investigate_user_activities_by_arn", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_ec2_instance_details_by_instanceid"]
+panels = ["panel://workbench_panel_aws_investigate_user_activities_by_arn", "panel://workbench_panel_get_ec2_instance_details_by_instanceid", "panel://workbench_panel_get_notable_history"]
 
 [panel_group://workbench_panel_group_unusual_processes]
 label = Unusual Processes
 description = Quickly identify systems running new or unusual processes in your environment that could be indicators of suspicious activity. Processes run from unusual locations, those with conspicuously long command lines, and rare executables are all examples of activities that may warrant deeper investigation.
 disabled = 0
-panels = ["panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table"]
+panels = ["panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_notable_history"]
 
 [panel_group://workbench_panel_group_use_of_cleartext_protocols]
 label = Use of Cleartext Protocols
 description = Leverage searches that detect cleartext network protocols that may leak credentials or should otherwise be encrypted.
 disabled = 0
-panels = ["panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_process_information_for_port_activity", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_user_information_from_identity_table"]
+panels = ["panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_process_information_for_port_activity", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_notable_history"]
 
 [panel_group://workbench_panel_group_web_fraud_detection]
 label = Web Fraud Detection
 description = Monitor your environment for activity consistent with common attack techniques bad actors use when attempting to compromise web servers or other web-related assets.
 disabled = 0
-panels = ["panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_emails_from_specific_sender", "panel://workbench_panel_get_web_session_information_via_session_id"]
+panels = ["panel://workbench_panel_get_emails_from_specific_sender", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_web_session_information_via_session_id", "panel://workbench_panel_get_notable_history"]
 
 [panel_group://workbench_panel_group_windows_defense_evasion_tactics]
 label = Windows Defense Evasion Tactics
 description = Detect tactics used by malware to evade defenses on Windows endpoints. A few of these include suspicious `reg.exe` processes, files hidden with `attrib.exe` and disabling user-account control, among many others 
 disabled = 0
-panels = ["panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_registry_activities"]
+panels = ["panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_registry_activities"]
 
 [panel_group://workbench_panel_group_windows_file_extension_and_association_abuse]
 label = Windows File Extension and Association Abuse
 description = Detect and investigate suspected abuse of file extensions and Windows file associations. Some of the malicious behaviors involved may include inserting spaces before file extensions or prepending the file extension with a different one, among other techniques.
 disabled = 0
-panels = ["panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_registry_activities"]
+panels = ["panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_registry_activities"]
 
 [panel_group://workbench_panel_group_windows_log_manipulation]
 label = Windows Log Manipulation
 description = Adversaries often try to cover their tracks by manipulating Windows logs. Use these searches to help you monitor for suspicious activity surrounding log files--an essential component of an effective defense.
 disabled = 0
-panels = ["panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_vulnerability_logs_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table"]
+panels = ["panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_vulnerability_logs_for_endpoint"]
 
 [panel_group://workbench_panel_group_windows_persistence_techniques]
 label = Windows Persistence Techniques
 description = Monitor for activities and techniques associated with maintaining persistence on a Windows system--a sign that an adversary may have compromised your environment.
 disabled = 0
-panels = ["panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_registry_activities"]
+panels = ["panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_registry_activities"]
 
 [panel_group://workbench_panel_group_windows_privilege_escalation]
 label = Windows Privilege Escalation
 description = Monitor for and investigate activities that may be associated with a Windows privilege-escalation attack, including unusual processes running on endpoints, modified registry keys, and more.
 disabled = 0
-panels = ["panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_registry_activities"]
+panels = ["panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_registry_activities"]
 
 [panel_group://workbench_panel_group_windows_service_abuse]
 label = Windows Service Abuse
 description = Windows services are often used by attackers for persistence and the ability to load drivers or otherwise interact with the Windows kernel. This Analytic Story helps you monitor your environment for indications that Windows services are being modified or created in a suspicious manner.
 disabled = 0
-panels = ["panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table"]
+panels = ["panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_notable_history"]
 
 
 

package/default/macros.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security-content
-# On Date: 2020-05-25T14:45:46 UTC
+# On Date: 2020-06-04T22:46:46 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -106,6 +106,42 @@ description = customer specific splunk configurations(eg- index, source, sourcet
 definition = lookup update=true is_windows_system_file filename as process_name OUTPUT systemFile | search systemFile=true
 description = This macro limits the output to process names that are in the Windows System directory
 
+[kubernetes_azure]
+definition = sourcetype=mscs:storage:blob:json
+description = customer specific splunk configurations(eg- index, source, sourcetype) for Kubernetes data from Azure. Replace the macro definition with configurations for your Splunk Environmnent.
+
+[kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace_filter]
+definition = search *
+description = Use this macro to add additional filters
+
+[kubernetes_azure_detect_rbac_authorization_by_account_filter]
+definition = search *
+description = Use this macro to add additional filters
+
+[kubernetes_azure_detect_sensitive_object_access_filter]
+definition = search *
+description = Use this macro to add additional filters
+
+[kubernetes_azure_detect_sensitive_role_access_filter]
+definition = search *
+description = Use this macro to add additional filters
+
+[kubernetes_azure_detect_service_accounts_forbidden_failure_access_filter]
+definition = search *
+description = Use this macro to add additional filters
+
+[kubernetes_azure_detect_suspicious_kubectl_calls_filter]
+definition = search *
+description = Use this macro to add additional filters
+
+[kubernetes_azure_pod_scan_fingerprint_detection_filter]
+definition = search *
+description = Use this macro to add additional filters
+
+[kubernetes_azure_scan_fingerprint_filter]
+definition = search *
+description = Use this macro to add additional filters
+
 [netbackup]
 definition = sourcetype="netbackup_logs"
 description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
@@ -134,6 +170,14 @@ description = Use this macro to determine how far into the past the window shoul
 definition = -70m@m
 description = Use this macro to determine how far into the past the window should be to determine if the region is new or not
 
+[previously_seen_zoom_child_processes_forget_window]
+definition = -90d@d
+description = Use this macro to determine how long to keep track of zoom child processes
+
+[previously_seen_zoom_child_processes_window]
+definition = -90d@d
+description = Use this macro to determine how far back you should be checking for new zoom child processes
+
 [prohibited_apps_launching_cmd]
 definition = | inputlookup prohibited_apps_launching_cmd | rename prohibited_applications as parent_process_name | eval parent_process_name="*" . parent_process_name | table parent_process_name
 description = This macro outputs a list of process that should not be the parent process of cmd.exe
@@ -591,6 +635,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
+[first_time_seen_child_process_of_zoom_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [first_time_seen_running_windows_service_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
@@ -619,6 +667,38 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
+[kubernetes_azure_detect_rbac_authorization_by_account_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[kubernetes_azure_detect_sensitive_object_access_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[kubernetes_azure_detect_sensitive_role_access_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[kubernetes_azure_detect_service_accounts_forbidden_failure_access_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[kubernetes_azure_detect_suspicious_kubectl_calls_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[kubernetes_azure_pod_scan_fingerprint_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[kubernetes_azure_scan_fingerprint_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [large_volume_of_dns_any_queries_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 

package/default/savedsearches.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security-content
-# On Date: 2020-05-25T14:45:46 UTC
+# On Date: 2020-06-04T22:46:46 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -209,7 +209,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `cloudtrail` eventName=AssumeRole | spath output=requestingAccountId path=userIdentity.accountId | spath output=requestedAccountId path=resources{}.accountId | search requestingAccountId=* | where requestingAccountId != requestedAccountId | inputlookup append=t previously_seen_aws_cross_account_activity | multireport [| stats min(eval(coalesce(firstTime, strptime(_time,"%Y-%m-%d %H:%M:%S")))) as firstTime max(eval(coalesce(strptime(_time,"%Y-%m-%d %H:%M:%S"), lastTime))) as lastTime by requestingAccountId, requestedAccountId | outputlookup previously_seen_aws_cross_account_activity | where fact=fiction] [| eventstats min(eval(coalesce(firstTime, strptime(_time,"%Y-%m-%d %H:%M:%S")))) as firstTime, max(eval(coalesce(strptime(_time,"%Y-%m-%d %H:%M:%S"), lastTime))) as lastTime by requestingAccountId, requestedAccountId | where firstTime >= relative_time(now(), "-70m@m") AND isnotnull(_time) | spath output=accessKeyId path=responseElements.credentials.accessKeyId | spath output=requestingARN path=resources{}.ARN | stats values(awsRegion) as awsRegion values(firstTime) as firstTime values(lastTime) as lastTime values(sharedEventID) as sharedEventID, values(requestingARN) as src_user, values(responseElements.assumedRoleUser.arn) as dest_user by _time, requestingAccountId, requestedAccountId, accessKeyId] | table _time, firstTime, lastTime, src_user, requestingAccountId, dest_user, requestedAccountId, awsRegion, accessKeyId, sharedEventID | `aws_cross_account_activity_from_previously_unseen_account_filter`
+search = `cloudtrail` eventName=AssumeRole | spath output=requestingAccountId path=userIdentity.accountId | spath output=requestedAccountId path=resources{}.accountId | search requestingAccountId=* | where requestingAccountId != requestedAccountId | inputlookup append=t previously_seen_aws_cross_account_activity | multireport [| stats min(eval(coalesce(firstTime, _time))) as firstTime max(eval(coalesce(lastTime, _time))) as lastTime by requestingAccountId, requestedAccountId | outputlookup previously_seen_aws_cross_account_activity | where fact=fiction] [| eventstats min(eval(coalesce(firstTime, _time))) as firstTime, max(eval(coalesce(lastTime, _time))) as lastTime by requestingAccountId, requestedAccountId | where firstTime >= relative_time(now(), "-70m@m") AND isnotnull(_time) | spath output=accessKeyId path=responseElements.credentials.accessKeyId | spath output=requestingARN path=resources{}.ARN | stats values(awsRegion) as awsRegion values(firstTime) as firstTime values(lastTime) as lastTime values(sharedEventID) as sharedEventID, values(requestingARN) as src_user, values(responseElements.assumedRoleUser.arn) as dest_user by _time, requestingAccountId, requestedAccountId, accessKeyId] | table _time, firstTime, lastTime, src_user, requestingAccountId, dest_user, requestedAccountId, awsRegion, accessKeyId, sharedEventID | `aws_cross_account_activity_from_previously_unseen_account_filter`
 
 [ESCU - AWS Network Access Control List Created with All Open Ports - Rule]
 action.escu = 0
@@ -2420,7 +2420,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect Prohibited Applications Spawning cmd exe - Rule
 action.escu.search_type = detection
 action.escu.providing_technologies = []
-action.escu.analytic_story = ["Suspicious Command-Line Executions", "Suspicious MSHTA Activity"]
+action.escu.analytic_story = ["Suspicious Command-Line Executions", "Suspicious MSHTA Activity", "Suspicious Zoom Child Processes"]
 cron_schedule = */30 * * * *
 dispatch.earliest_time = -30m
 dispatch.latest_time = now
@@ -3892,6 +3892,46 @@ realtime_schedule = 0
 is_visible = false
 search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Filesystem.user) as user values(Filesystem.dest) as dest values(Filesystem.file_path) as file_path from datamodel=Endpoint.Filesystem by Filesystem.file_name | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`| rex field=file_name "(?<file_extension>\.[^\.]+)$" | search file_extension=.stubbin OR file_extension=.berkshire OR file_extension=.satoshi OR file_extension=.sophos OR file_extension=.keyxml | `file_with_samsam_extension_filter`
 
+[ESCU - First Time Seen Child Process of Zoom - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = This search looks for child processes spawned by zoom.exe or zoom.us that has not previously been seen.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1068"], "nist": ["PR.PT", "DE.CM", "PR.IP"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = This search looks for child processes spawned by zoom.exe or zoom.us that has not previously been seen.
+action.escu.how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You should run the baseline search `Previously Seen Zoom Child Processes - Initial` to build the initial table of child processes and hostnames for this search to work. You should also schedule at the same interval as this search the second baseline search `Previously Seen Zoom Child Processes - Update` to keep this table up to date and to age out old child processes. Please update the `previously_seen_zoom_child_processes_window` macro to adjust the time window.
+action.escu.known_false_positives = A new child process of zoom isn't malicious by that fact alone. Further investigation of the actions of the child process is needed to verify any malicious behavior is taken.
+action.escu.creation_date = 2020-05-20
+action.escu.modification_date = 2020-05-20
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - First Time Seen Child Process of Zoom - Rule
+action.escu.search_type = detection
+action.escu.providing_technologies = []
+action.escu.analytic_story = ["Suspicious Zoom Child Processes"]
+cron_schedule = */30 * * * *
+dispatch.earliest_time = -30m
+dispatch.latest_time = now
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - First Time Seen Child Process of Zoom - Rule
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = ['dest']
+action.notable.param.rule_description = This search looks for child processes spawned by zoom.exe or zoom.us that has not previously been seen.
+action.notable.param.rule_title = First Time Seen Child Process of Zoom
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+action.escu.earliest_time_offset = 3600
+action.escu.latest_time_offset = 86400
+disabled = true
+enableSched = 1
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` min(_time) as firstTime values(Processes.parent_process_name) as parent_process_name values(Processes.parent_process_id) as parent_process_id values(Processes.process_name) as process_name values(Processes.process) as process from datamodel=Endpoint.Processes where (Processes.parent_process_name=zoom.exe OR Processes.parent_process_name=zoom.us) by Processes.process_id Processes.dest | `drop_dm_object_name(Processes)` | lookup zoom_first_time_child_process dest as dest process_name as process_name OUTPUT firstTimeSeen | where isnull(firstTimeSeen) OR firstTimeSeen > relative_time(now(), "`previously_seen_zoom_child_processes_window`") | `security_content_ctime(firstTime)` | table firstTime dest, process_id, process_name, parent_process_id, parent_process_name |`first_time_seen_child_process_of_zoom_filter`
+
 [ESCU - First Time Seen Running Windows Service - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -4168,6 +4208,318 @@ realtime_schedule = 0
 is_visible = false
 search = | from datamodel Identity_Management.All_Identities  | eval empStatus=case((now()-startDate)<604800, "Accounts created in last week") | search empStatus="Accounts created in last week"| `security_content_ctime(endDate)` | `security_content_ctime(startDate)`| table identity empStatus endDate startDate | `identify_new_user_accounts_filter`
 
+[ESCU - Kubernetes Azure detect RBAC authorization by account - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = This search provides information on Kubernetes RBAC authorizations by accounts, this search can be modified by adding rare or top to see both extremes of RBAC by accounts occurrences
+action.escu.mappings = {"kill_chain_phases": ["Lateral Movement"]}
+action.escu.data_models = []
+action.escu.eli5 = This search provides information on Kubernetes RBAC authorizations by accounts, this search can be modified by adding rare or top to see both extremes of RBAC by accounts occurrences
+action.escu.how_to_implement = You must install the Add-on for Microsoft Cloud Services and Configure Kube-Audit data diagnostics
+action.escu.known_false_positives = Not all RBAC Authorications are malicious. RBAC authorizations can uncover malicious activity specially if sensitive Roles have been granted.
+action.escu.creation_date = 2020-05-26
+action.escu.modification_date = 2020-05-26
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Kubernetes Azure detect RBAC authorization by account - Rule
+action.escu.search_type = detection
+action.escu.providing_technologies = []
+action.escu.analytic_story = ["Kubernetes Sensitive Role Activity"]
+cron_schedule = */30 * * * *
+dispatch.earliest_time = -30m
+dispatch.latest_time = now
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Kubernetes Azure detect RBAC authorization by account - Rule
+schedule_window = auto
+action.notable = 1
+action.notable.param.rule_description = This search provides information on Kubernetes RBAC authorizations by accounts, this search can be modified by adding rare or top to see both extremes of RBAC by accounts occurrences
+action.notable.param.rule_title = Kubernetes Azure detect RBAC authorization by account
+action.notable.param.security_domain = threat
+action.notable.param.severity = high
+alert.digest_mode = 1
+action.escu.earliest_time_offset = 3600
+action.escu.latest_time_offset = 86400
+disabled = true
+enableSched = 1
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = sourcetype:mscs:storage:blob:json category=kube-audit | spath input=properties.log | search annotations.authorization.k8s.io/reason=* | table sourceIPs{} user.username userAgent annotations.authorization.k8s.io/reason |stats count by user.username annotations.authorization.k8s.io/reason | rare user.username annotations.authorization.k8s.io/reason |`kubernetes_azure_detect_rbac_authorization_by_account_filter`
+
+[ESCU - Kubernetes Azure detect most active service accounts by pod namespace - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = This search provides information on Kubernetes service accounts,accessing pods and namespaces by IP address and verb
+action.escu.mappings = {"kill_chain_phases": ["Lateral Movement"]}
+action.escu.data_models = []
+action.escu.eli5 = This search provides information on Kubernetes service accounts,accessing pods and namespaces by IP address and verb
+action.escu.how_to_implement = You must install the Add-on for Microsoft Cloud Services and Configure Kube-Audit data diagnostics
+action.escu.known_false_positives = Not all service accounts interactions are malicious. Analyst must consider IP and verb context when trying to detect maliciousness.
+action.escu.creation_date = 2020-05-26
+action.escu.modification_date = 2020-05-26
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Kubernetes Azure detect most active service accounts by pod namespace - Rule
+action.escu.search_type = detection
+action.escu.providing_technologies = []
+action.escu.analytic_story = ["Kubernetes Sensitive Role Activity"]
+cron_schedule = */30 * * * *
+dispatch.earliest_time = -30m
+dispatch.latest_time = now
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Kubernetes Azure detect most active service accounts by pod namespace - Rule
+schedule_window = auto
+action.notable = 1
+action.notable.param.rule_description = This search provides information on Kubernetes service accounts,accessing pods and namespaces by IP address and verb
+action.notable.param.rule_title = Kubernetes Azure detect most active service accounts by pod namespace
+action.notable.param.security_domain = threat
+action.notable.param.severity = high
+alert.digest_mode = 1
+action.escu.earliest_time_offset = 3600
+action.escu.latest_time_offset = 86400
+disabled = true
+enableSched = 1
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = sourcetype:mscs:storage:blob:json category=kube-audit | spath input=properties.log | search user.groups{}=system:serviceaccounts*  | table  sourceIPs{} user.username userAgent verb responseStatus.reason responseStatus.status properties.pod objectRef.namespace | top sourceIPs{} user.username verb responseStatus.status properties.pod objectRef.namespace |`kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace_filter`
+
+[ESCU - Kubernetes Azure detect sensitive object access - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = This search provides information on Kubernetes accounts accessing sensitve objects such as configmpas or secrets
+action.escu.mappings = {"kill_chain_phases": ["Lateral Movement"]}
+action.escu.data_models = []
+action.escu.eli5 = This search provides information on Kubernetes accounts accessing sensitve objects such as configmpas or secrets
+action.escu.how_to_implement = You must install the Add-on for Microsoft Cloud Services and Configure Kube-Audit data diagnostics
+action.escu.known_false_positives = Sensitive object access is not necessarily malicious but user and object context can provide guidance for detection.
+action.escu.creation_date = 2020-05-20
+action.escu.modification_date = 2020-05-20
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Kubernetes Azure detect sensitive object access - Rule
+action.escu.search_type = detection
+action.escu.providing_technologies = []
+action.escu.analytic_story = ["Kubernetes Sensitive Object Access Activity"]
+cron_schedule = */30 * * * *
+dispatch.earliest_time = -30m
+dispatch.latest_time = now
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Kubernetes Azure detect sensitive object access - Rule
+schedule_window = auto
+action.notable = 1
+action.notable.param.rule_description = This search provides information on Kubernetes accounts accessing sensitve objects such as configmpas or secrets
+action.notable.param.rule_title = Kubernetes Azure detect sensitive object access
+action.notable.param.security_domain = threat
+action.notable.param.severity = high
+alert.digest_mode = 1
+action.escu.earliest_time_offset = 3600
+action.escu.latest_time_offset = 86400
+disabled = true
+enableSched = 1
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `kubernetes_azure` category=kube-audit | spath input=properties.log| search objectRef.resource=secrets OR configmaps |table user.username user.groups{} objectRef.resource objectRef.namespace objectRef.name annotations.authorization.k8s.io/reason |dedup user.username user.groups{} |`kubernetes_azure_detect_sensitive_object_access_filter`
+
+[ESCU - Kubernetes Azure detect sensitive role access - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = This search provides information on Kubernetes accounts accessing sensitve objects such as configmpas or secrets
+action.escu.mappings = {"kill_chain_phases": ["Lateral Movement"]}
+action.escu.data_models = []
+action.escu.eli5 = This search provides information on Kubernetes accounts accessing sensitve objects such as configmpas or secrets
+action.escu.how_to_implement = You must install the Add-on for Microsoft Cloud Services and Configure Kube-Audit data diagnostics
+action.escu.known_false_positives = Sensitive role resource access is necessary for cluster operation, however source IP, namespace and user group may indicate possible malicious use. 
+action.escu.creation_date = 2020-05-20
+action.escu.modification_date = 2020-05-20
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Kubernetes Azure detect sensitive role access - Rule
+action.escu.search_type = detection
+action.escu.providing_technologies = []
+action.escu.analytic_story = ["Kubernetes Sensitive Role Activity"]
+cron_schedule = */30 * * * *
+dispatch.earliest_time = -30m
+dispatch.latest_time = now
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Kubernetes Azure detect sensitive role access - Rule
+schedule_window = auto
+action.notable = 1
+action.notable.param.rule_description = This search provides information on Kubernetes accounts accessing sensitve objects such as configmpas or secrets
+action.notable.param.rule_title = Kubernetes Azure detect sensitive role access
+action.notable.param.security_domain = threat
+action.notable.param.severity = high
+alert.digest_mode = 1
+action.escu.earliest_time_offset = 3600
+action.escu.latest_time_offset = 86400
+disabled = true
+enableSched = 1
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `kubernetes_azure` category=kube-audit | spath input=properties.log| search objectRef.resource=clusterroles OR clusterrolebindings | table sourceIPs{} user.username user.groups{} objectRef.namespace requestURI annotations.authorization.k8s.io/reason | dedup user.username user.groups{} |`kubernetes_azure_detect_sensitive_role_access_filter`
+
+[ESCU - Kubernetes Azure detect service accounts forbidden failure access - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = This search provides information on Kubernetes service accounts with failure or forbidden access status
+action.escu.mappings = {"kill_chain_phases": ["Lateral Movement"]}
+action.escu.data_models = []
+action.escu.eli5 = This search provides information on Kubernetes service accounts with failure or forbidden access status
+action.escu.how_to_implement = You must install the Add-on for Microsoft Cloud Services and Configure Kube-Audit data diagnostics
+action.escu.known_false_positives = This search can give false positives as there might be inherent issues with authentications and permissions at cluster.
+action.escu.creation_date = 2020-05-20
+action.escu.modification_date = 2020-05-20
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Kubernetes Azure detect service accounts forbidden failure access - Rule
+action.escu.search_type = detection
+action.escu.providing_technologies = []
+action.escu.analytic_story = ["Kubernetes Sensitive Object Access Activity"]
+cron_schedule = */30 * * * *
+dispatch.earliest_time = -30m
+dispatch.latest_time = now
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Kubernetes Azure detect service accounts forbidden failure access - Rule
+schedule_window = auto
+action.notable = 1
+action.notable.param.rule_description = This search provides information on Kubernetes service accounts with failure or forbidden access status
+action.notable.param.rule_title = Kubernetes Azure detect service accounts forbidden failure access
+action.notable.param.security_domain = threat
+action.notable.param.severity = high
+alert.digest_mode = 1
+action.escu.earliest_time_offset = 3600
+action.escu.latest_time_offset = 86400
+disabled = true
+enableSched = 1
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `kubernetes_azure` category=kube-audit | spath input=properties.log | search user.groups{}=system:serviceaccounts*  responseStatus.reason=Forbidden | table  sourceIPs{} user.username userAgent verb responseStatus.reason responseStatus.status properties.pod objectRef.namespace  |`kubernetes_azure_detect_service_accounts_forbidden_failure_access_filter`
+
+[ESCU - Kubernetes Azure detect suspicious kubectl calls - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = This search provides information on Kubectl calls with IP, verb namespace and object access context
+action.escu.mappings = {"kill_chain_phases": ["Lateral Movement"]}
+action.escu.data_models = []
+action.escu.eli5 = This search provides information on Kubectl calls with IP, verb namespace and object access context
+action.escu.how_to_implement = You must install the Add-on for Microsoft Cloud Services and Configure Kube-Audit data diagnostics
+action.escu.known_false_positives = Kubectl calls are not malicious by nature. However source IP, verb and Object can reveal potential malicious activity, specially suspicious IPs and sensitive objects such as configmaps or secrets
+action.escu.creation_date = 2020-05-26
+action.escu.modification_date = 2020-05-26
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Kubernetes Azure detect suspicious kubectl calls - Rule
+action.escu.search_type = detection
+action.escu.providing_technologies = []
+action.escu.analytic_story = ["Kubernetes Sensitive Object Access Activity"]
+cron_schedule = */30 * * * *
+dispatch.earliest_time = -30m
+dispatch.latest_time = now
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Kubernetes Azure detect suspicious kubectl calls - Rule
+schedule_window = auto
+action.notable = 1
+action.notable.param.rule_description = This search provides information on Kubectl calls with IP, verb namespace and object access context
+action.notable.param.rule_title = Kubernetes Azure detect suspicious kubectl calls
+action.notable.param.security_domain = threat
+action.notable.param.severity = high
+alert.digest_mode = 1
+action.escu.earliest_time_offset = 3600
+action.escu.latest_time_offset = 86400
+disabled = true
+enableSched = 1
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `kubernetes_azure` category=kube-audit | spath input=properties.log| search objectRef.resource=secrets OR configmaps |table user.username user.groups{} objectRef.resource objectRef.namespace objectRef.name annotations.authorization.k8s.io/reason |dedup user.username user.groups{} |`kubernetes_azure_detect_suspicious_kubectl_calls_filter`
+
+[ESCU - Kubernetes Azure pod scan fingerprint - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = This search provides information of unauthenticated requests via source IP user agent, request URI and response status data against Kubernetes cluster pod in Azure
+action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"]}
+action.escu.data_models = []
+action.escu.eli5 = This search provides information of unauthenticated requests via source IP user agent, request URI and response status data against Kubernetes cluster pod in Azure
+action.escu.how_to_implement = You must install the Add-on for Microsoft Cloud Services and Configure Kube-Audit data diagnostics
+action.escu.known_false_positives = Not all unauthenticated requests are malicious, but source IPs, userAgent, verb, request URI and response status will provide context.
+action.escu.creation_date = 2020-05-20
+action.escu.modification_date = 2020-05-20
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Kubernetes Azure pod scan fingerprint - Rule
+action.escu.search_type = detection
+action.escu.providing_technologies = []
+action.escu.analytic_story = ["Kubernetes Scanning Activity"]
+cron_schedule = */30 * * * *
+dispatch.earliest_time = -30m
+dispatch.latest_time = now
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Kubernetes Azure pod scan fingerprint - Rule
+schedule_window = auto
+action.notable = 1
+action.notable.param.rule_description = This search provides information of unauthenticated requests via source IP user agent, request URI and response status data against Kubernetes cluster pod in Azure
+action.notable.param.rule_title = Kubernetes Azure pod scan fingerprint
+action.notable.param.security_domain = threat
+action.notable.param.severity = high
+alert.digest_mode = 1
+action.escu.earliest_time_offset = 3600
+action.escu.latest_time_offset = 86400
+disabled = true
+enableSched = 1
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `kubernetes_azure` category=kube-audit | spath input=properties.log | search responseStatus.code=401 | table  sourceIPs{} userAgent verb requestURI responseStatus.reason properties.pod |`kubernetes_azure_pod_scan_fingerprint_filter`
+
+[ESCU - Kubernetes Azure scan fingerprint - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = This search provides information of unauthenticated requests via source IP user agent, request URI and response status data against Kubernetes cluster in Azure
+action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"]}
+action.escu.data_models = []
+action.escu.eli5 = This search provides information of unauthenticated requests via source IP user agent, request URI and response status data against Kubernetes cluster in Azure
+action.escu.how_to_implement = You must install the Add-on for Microsoft Cloud Services and Configure Kube-Audit data diagnostics
+action.escu.known_false_positives = Not all unauthenticated requests are malicious, but source IPs, userAgent, verb, request URI and response status will provide context.
+action.escu.creation_date = 2020-05-19
+action.escu.modification_date = 2020-05-19
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Kubernetes Azure scan fingerprint - Rule
+action.escu.search_type = detection
+action.escu.providing_technologies = []
+action.escu.analytic_story = ["Kubernetes Scanning Activity"]
+cron_schedule = */30 * * * *
+dispatch.earliest_time = -30m
+dispatch.latest_time = now
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Kubernetes Azure scan fingerprint - Rule
+schedule_window = auto
+action.notable = 1
+action.notable.param.rule_description = This search provides information of unauthenticated requests via source IP user agent, request URI and response status data against Kubernetes cluster in Azure
+action.notable.param.rule_title = Kubernetes Azure scan fingerprint
+action.notable.param.security_domain = threat
+action.notable.param.severity = high
+alert.digest_mode = 1
+action.escu.earliest_time_offset = 3600
+action.escu.latest_time_offset = 86400
+disabled = true
+enableSched = 1
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `kubernetes_azure` category=kube-audit | spath input=properties.log | search responseStatus.code=401 | table  sourceIPs{} userAgent verb requestURI responseStatus.reason |`kubernetes_azure_scan_fingerprint_filter`
+
 [ESCU - Large Volume of DNS ANY Queries - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -7597,7 +7949,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime
 
 ### ESCU BASELINES ###
 
-[ESCU - Add Prohibited Processes to Enterprise Security - Baseline]
+[ESCU - Add Prohibited Processes to Enterprise Security]
 action.escu = 0
 action.escu.enabled = 1
 action.escu.search_type = support
@@ -7617,7 +7969,7 @@ disabled = true
 is_visible = false
 search = | inputlookup interesting_processes_lookup | search note!=ESCU* | inputlookup append=T prohibitedProcesses_lookup | fillnull value=* dest dest_pci_domain | fillnull value=false is_required is_secure | fillnull value=true is_prohibited | outputlookup interesting_processes_lookup | stats count
 
-[ESCU - Baseline of API Calls per User ARN - Baseline]
+[ESCU - Baseline of API Calls per User ARN]
 action.escu = 0
 action.escu.enabled = 1
 action.escu.search_type = support
@@ -7637,7 +7989,7 @@ disabled = true
 is_visible = false
 search = `cloudtrail` eventType=AwsApiCall | spath output=arn path=userIdentity.arn | bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls) as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls, stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls | outputlookup api_call_by_user_baseline | stats count
 
-[ESCU - Baseline of Command Line Length - MLTK - Baseline]
+[ESCU - Baseline of Command Line Length - MLTK]
 action.escu = 0
 action.escu.enabled = 1
 action.escu.search_type = support
@@ -7657,7 +8009,7 @@ disabled = true
 is_visible = false
 search = | tstats `security_content_summariesonly` count min(_time) as start_time max(_time) as end_time FROM datamodel=Endpoint.Processes by Processes.user Processes.dest Processes.process_name Processes.process | `drop_dm_object_name(Processes)` | search user!=unknown | `security_content_ctime(start_time)`| `security_content_ctime(end_time)`| eval processlen=len(process) | fit DensityFunction processlen by user into cmdline_pdfmodel
 
-[ESCU - Baseline of DNS Query Length - MLTK - Baseline]
+[ESCU - Baseline of DNS Query Length - MLTK]
 action.escu = 0
 action.escu.enabled = 1
 action.escu.search_type = support
@@ -7677,7 +8029,7 @@ disabled = true
 is_visible = false
 search = | tstats `security_content_summariesonly` count from datamodel=Network_Resolution by DNS.query DNS.record_type | search DNS.record_type=* | `drop_dm_object_name("DNS")` | eval query_length = len(query) | fit DensityFunction query_length by record_type into dns_query_pdfmodel
 
-[ESCU - Baseline of Excessive AWS Instances Launched by User - MLTK - Baseline]
+[ESCU - Baseline of Excessive AWS Instances Launched by User - MLTK]
 action.escu = 0
 action.escu.enabled = 1
 action.escu.search_type = support
@@ -7699,7 +8051,7 @@ disabled = true
 is_visible = false
 search = `cloudtrail` eventName=RunInstances errorCode=success `ec2_excessive_runinstances_mltk_input_filter` | bucket span=10m _time | stats count as instances_launched by _time src_user | fit DensityFunction instances_launched threshold=0.0005 into ec2_excessive_runinstances_v1
 
-[ESCU - Baseline of Excessive AWS Instances Terminated by User - MLTK - Baseline]
+[ESCU - Baseline of Excessive AWS Instances Terminated by User - MLTK]
 action.escu = 0
 action.escu.enabled = 1
 action.escu.search_type = support
@@ -7721,7 +8073,7 @@ disabled = true
 is_visible = false
 search = `cloudtrail` eventName=TerminateInstances errorCode=success `ec2_excessive_terminateinstances_mltk_input_filter` | bucket span=10m _time | stats count as instances_terminated by _time src_user | fit DensityFunction instances_terminated threshold=0.0005 into ec2_excessive_terminateinstances_v1
 
-[ESCU - Baseline of Network ACL Activity by ARN - Baseline]
+[ESCU - Baseline of Network ACL Activity by ARN]
 action.escu = 0
 action.escu.enabled = 1
 action.escu.search_type = support
@@ -7741,7 +8093,7 @@ disabled = true
 is_visible = false
 search = `cloudtrail` `network_acl_events` | spath output=arn path=userIdentity.arn | bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls) as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls, stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls | outputlookup network_acl_activity_baseline | stats count
 
-[ESCU - Baseline of S3 Bucket deletion activity by ARN - Baseline]
+[ESCU - Baseline of S3 Bucket deletion activity by ARN]
 action.escu = 0
 action.escu.enabled = 1
 action.escu.search_type = support
@@ -7761,7 +8113,7 @@ disabled = true
 is_visible = false
 search = `cloudtrail` eventName=DeleteBucket | spath output=arn path=userIdentity.arn | bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls) as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls, stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls | outputlookup s3_deletion_baseline | stats count
 
-[ESCU - Baseline of SMB Traffic - MLTK - Baseline]
+[ESCU - Baseline of SMB Traffic - MLTK]
 action.escu = 0
 action.escu.enabled = 1
 action.escu.search_type = support
@@ -7781,7 +8133,7 @@ disabled = true
 is_visible = false
 search = | tstats `security_content_summariesonly` count from datamodel=Network_Traffic where All_Traffic.dest_port=139 OR All_Traffic.dest_port=445 OR All_Traffic.app=smb by _time span=10m, All_Traffic.src | eval HourOfDay=strftime(_time, "%H") | eval DayOfWeek=strftime(_time, "%A") | `drop_dm_object_name("All_Traffic")` | fit DensityFunction count by "HourOfDay,DayOfWeek" into smb_pdfmodel
 
-[ESCU - Baseline of Security Group Activity by ARN - Baseline]
+[ESCU - Baseline of Security Group Activity by ARN]
 action.escu = 0
 action.escu.enabled = 1
 action.escu.search_type = support
@@ -7801,7 +8153,7 @@ disabled = true
 is_visible = false
 search = `cloudtrail` `security_group_api_calls` | spath output=arn path=userIdentity.arn | bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls) as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls, stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls | outputlookup security_group_activity_baseline | stats count
 
-[ESCU - Baseline of blocked outbound traffic from AWS - Baseline]
+[ESCU - Baseline of blocked outbound traffic from AWS]
 action.escu = 0
 action.escu.enabled = 1
 action.escu.search_type = support
@@ -7821,7 +8173,7 @@ disabled = true
 is_visible = false
 search = `cloudwatchlogs_vpcflow` action=blocked (src_ip=10.0.0.0/8 OR src_ip=172.16.0.0/12 OR src_ip=192.168.0.0/16) ( dest_ip!=10.0.0.0/8 AND dest_ip!=172.16.0.0/12 AND dest_ip!=192.168.0.0/16) | bucket _time span=1h | stats count as numberOfBlockedConnections by _time, src_ip | stats count(numberOfBlockedConnections) as numDataPoints, latest(numberOfBlockedConnections) as latestCount, avg(numberOfBlockedConnections) as avgBlockedConnections, stdev(numberOfBlockedConnections) as stdevBlockedConnections by src_ip | table src_ip, latestCount, numDataPoints, avgBlockedConnections, stdevBlockedConnections | outputlookup baseline_blocked_outbound_connections | stats count
 
-[ESCU - Count of Unique IPs Connecting to Ports - Baseline]
+[ESCU - Count of Unique IPs Connecting to Ports]
 action.escu = 0
 action.escu.enabled = 1
 action.escu.search_type = support
@@ -7841,7 +8193,7 @@ disabled = true
 is_visible = false
 search = | tstats `security_content_summariesonly` count dc(All_Traffic.src) as numberOfUniqueHosts from datamodel=Network_Traffic by All_Traffic.dest_port | `drop_dm_object_name("All_Traffic")` | sort - count
 
-[ESCU - Count of assets by category - Baseline]
+[ESCU - Count of assets by category]
 action.escu = 0
 action.escu.enabled = 1
 action.escu.search_type = support
@@ -7861,7 +8213,7 @@ disabled = true
 is_visible = false
 search = | from datamodel Identity_Management.All_Assets | stats count values(nt_host) by category | sort -count
 
-[ESCU - Create a list of approved AWS service accounts - Baseline]
+[ESCU - Create a list of approved AWS service accounts]
 action.escu = 0
 action.escu.enabled = 1
 action.escu.search_type = support
@@ -7881,7 +8233,7 @@ disabled = true
 is_visible = false
 search = `cloudtrail` errorCode=success | rename userName as identity | search NOT [inputlookup identity_lookup_expanded | fields identity] | stats count by identity | table identity | outputlookup aws_service_accounts | stats count
 
-[ESCU - DNSTwist Domain Names - Baseline]
+[ESCU - DNSTwist Domain Names]
 action.escu = 0
 action.escu.enabled = 1
 action.escu.search_type = support
@@ -7901,7 +8253,7 @@ disabled = true
 is_visible = false
 search = | dnstwist domainlist=domains.csv | `remove_valid_domains` | eval domain_abuse="true" | table domain, domain_abuse | outputlookup brandMonitoring_lookup | stats count
 
-[ESCU - Discover DNS records - Baseline]
+[ESCU - Discover DNS records]
 action.escu = 0
 action.escu.enabled = 1
 action.escu.search_type = support
@@ -7921,7 +8273,7 @@ disabled = true
 is_visible = false
 search = | inputlookup cim_corporate_email_domains.csv | inputlookup append=T cim_corporate_web_domains.csv | inputlookup append=T cim_cloud_domains.csv | eval domain = trim(replace(domain, "\*", "")) | join domain [|tstats `security_content_summariesonly` count values(DNS.record_type) as type, values(DNS.answer) as answer from datamodel=Network_Resolution where DNS.message_type=RESPONSE DNS.answer!="unknown" DNS.answer!="" by DNS.query | rename DNS.query as query | where query!="unknown" | rex field=query "(?<domain>\w+\.\w+?)(?:$|/)"] | makemv delim=" " answer |  makemv delim=" " type | sort -count | table count,domain,type,query,answer | outputlookup createinapp=true discovered_dns_records.csv
 
-[ESCU - Identify Systems Creating Remote Desktop Traffic - Baseline]
+[ESCU - Identify Systems Creating Remote Desktop Traffic]
 action.escu = 0
 action.escu.enabled = 1
 action.escu.search_type = support
@@ -7941,7 +8293,7 @@ disabled = true
 is_visible = false
 search = | tstats `security_content_summariesonly` count from datamodel=Network_Traffic where All_Traffic.dest_port=3389 by All_Traffic.src | `drop_dm_object_name("All_Traffic")` | sort - count
 
-[ESCU - Identify Systems Receiving Remote Desktop Traffic - Baseline]
+[ESCU - Identify Systems Receiving Remote Desktop Traffic]
 action.escu = 0
 action.escu.enabled = 1
 action.escu.search_type = support
@@ -7961,7 +8313,7 @@ disabled = true
 is_visible = false
 search = | tstats `security_content_summariesonly` count from datamodel=Network_Traffic where All_Traffic.dest_port=3389 by All_Traffic.dest | `drop_dm_object_name("All_Traffic")` | sort - count
 
-[ESCU - Identify Systems Using Remote Desktop - Baseline]
+[ESCU - Identify Systems Using Remote Desktop]
 action.escu = 0
 action.escu.enabled = 1
 action.escu.search_type = support
@@ -7981,7 +8333,7 @@ disabled = true
 is_visible = false
 search = | tstats `security_content_summariesonly` count from datamodel=Endpoint.Processes where Processes.process_name="*mstsc.exe*" by Processes.dest Processes.process_name | `drop_dm_object_name(Processes)` | sort - count
 
-[ESCU - Monitor Successful Backups - Baseline]
+[ESCU - Monitor Successful Backups]
 action.escu = 0
 action.escu.enabled = 1
 action.escu.search_type = support
@@ -8001,7 +8353,7 @@ disabled = true
 is_visible = false
 search = `netbackup` "Disk/Partition backup completed successfully." | bucket _time span=1d | stats dc(COMPUTERNAME) as count values(COMPUTERNAME) as dest by _time, MESSAGE
 
-[ESCU - Monitor Unsuccessful Backups - Baseline]
+[ESCU - Monitor Unsuccessful Backups]
 action.escu = 0
 action.escu.enabled = 1
 action.escu.search_type = support
@@ -8021,7 +8373,7 @@ disabled = true
 is_visible = false
 search = `netbackup` "An error occurred, failed to backup." | bucket _time span=1d | stats dc(COMPUTERNAME) as count values(COMPUTERNAME) as dest by _time, MESSAGE
 
-[ESCU - Previously Seen AWS Cross Account Activity - Baseline]
+[ESCU - Previously Seen AWS Cross Account Activity]
 action.escu = 0
 action.escu.enabled = 1
 action.escu.search_type = support
@@ -8041,7 +8393,7 @@ disabled = true
 is_visible = false
 search = `cloudtrail` eventName=AssumeRole | spath output=requestingAccountId path=userIdentity.accountId | spath output=requestedAccountId path=resources{}.accountId | search requestingAccountId=* | where requestingAccountId!=requestedAccountId | stats earliest(_time) as firstTime latest(_time) as lastTime by requestingAccountId, requestedAccountId | outputlookup previously_seen_aws_cross_account_activity | stats count
 
-[ESCU - Previously Seen AWS Provisioning Activity Sources - Baseline]
+[ESCU - Previously Seen AWS Provisioning Activity Sources]
 action.escu = 0
 action.escu.enabled = 1
 action.escu.search_type = support
@@ -8061,7 +8413,7 @@ disabled = true
 is_visible = false
 search = `cloudtrail` (eventName=Run* OR eventName=Create*) | iplocation sourceIPAddress | stats earliest(_time) as firstTime, latest(_time) as lastTime by sourceIPAddress, City, Region, Country | outputlookup previously_seen_provisioning_activity_src.csv | stats count
 
-[ESCU - Previously Seen AWS Regions - Baseline]
+[ESCU - Previously Seen AWS Regions]
 action.escu = 0
 action.escu.enabled = 1
 action.escu.search_type = support
@@ -8081,7 +8433,7 @@ disabled = true
 is_visible = false
 search = `cloudtrail` StartInstances | stats earliest(_time) as earliest latest(_time) as latest by awsRegion | outputlookup previously_seen_aws_regions.csv | stats count
 
-[ESCU - Previously Seen Cloud Compute Creations By User - Baseline]
+[ESCU - Previously Seen Cloud Compute Creations By User]
 action.escu = 0
 action.escu.enabled = 1
 action.escu.search_type = support
@@ -8101,7 +8453,7 @@ disabled = true
 is_visible = false
 search = | tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Cloud_Infrastructure.Compute where Compute.action=run `previously_seen_cloud_compute_creations_by_user_input_filter` by Compute.src_user | `drop_dm_object_name("Compute")` | outputlookup previously_seen_cloud_compute_creations_by_user | stats count
 
-[ESCU - Previously Seen Cloud Compute Images - Baseline]
+[ESCU - Previously Seen Cloud Compute Images]
 action.escu = 0
 action.escu.enabled = 1
 action.escu.search_type = support
@@ -8121,7 +8473,7 @@ disabled = true
 is_visible = false
 search = | tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Cloud_Infrastructure.Compute where Compute.action=run `previously_seen_cloud_compute_image_input_filter` by Compute.image_id | `drop_dm_object_name("Compute")` | outputlookup previously_seen_cloud_compute_images | stats count
 
-[ESCU - Previously Seen Cloud Compute Instance Types - Baseline]
+[ESCU - Previously Seen Cloud Compute Instance Types]
 action.escu = 0
 action.escu.enabled = 1
 action.escu.search_type = support
@@ -8141,7 +8493,7 @@ disabled = true
 is_visible = false
 search = | tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Cloud_Infrastructure.Compute where Compute.action=run `previously_seen_cloud_compute_instance_types_input_filter` by Compute.instance_type | `drop_dm_object_name("Compute")` | outputlookup previously_seen_cloud_compute_instance_types | stats count
 
-[ESCU - Previously Seen Cloud Regions - Baseline]
+[ESCU - Previously Seen Cloud Regions]
 action.escu = 0
 action.escu.enabled = 1
 action.escu.search_type = support
@@ -8161,7 +8513,7 @@ disabled = true
 is_visible = false
 search = | tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Cloud_Infrastructure.Compute where Compute.action=start `previously_seen_cloud_regions_input_filter` by Compute.region | `drop_dm_object_name("Compute")` | outputlookup previously_seen_cloud_regions | stats count
 
-[ESCU - Previously Seen EC2 AMIs - Baseline]
+[ESCU - Previously Seen EC2 AMIs]
 action.escu = 0
 action.escu.enabled = 1
 action.escu.search_type = support
@@ -8181,7 +8533,7 @@ disabled = true
 is_visible = false
 search = `cloudtrail` eventName=RunInstances errorCode=success | rename requestParameters.instancesSet.items{}.imageId as amiID | stats earliest(_time) as firstTime latest(_time) as lastTime by amiID | outputlookup previously_seen_ec2_amis.csv | stats count
 
-[ESCU - Previously Seen EC2 Instance Types - Baseline]
+[ESCU - Previously Seen EC2 Instance Types]
 action.escu = 0
 action.escu.enabled = 1
 action.escu.search_type = support
@@ -8201,7 +8553,7 @@ disabled = true
 is_visible = false
 search = `cloudtrail` eventName=RunInstances errorCode=success | rename requestParameters.instanceType as instanceType | fillnull value="m1.small" instanceType | stats earliest(_time) as earliest latest(_time) as latest by instanceType | outputlookup previously_seen_ec2_instance_types.csv | stats count
 
-[ESCU - Previously Seen EC2 Launches By User - Baseline]
+[ESCU - Previously Seen EC2 Launches By User]
 action.escu = 0
 action.escu.enabled = 1
 action.escu.search_type = support
@@ -8221,7 +8573,7 @@ disabled = true
 is_visible = false
 search = `cloudtrail` eventName=RunInstances errorCode=success | rename userIdentity.arn as arn | stats earliest(_time) as firstTime latest(_time) as lastTime by arn | outputlookup previously_seen_ec2_launches_by_user.csv | stats count
 
-[ESCU - Previously Seen EC2 Modifications By User - Baseline]
+[ESCU - Previously Seen EC2 Modifications By User]
 action.escu = 0
 action.escu.enabled = 1
 action.escu.search_type = support
@@ -8241,7 +8593,7 @@ disabled = true
 is_visible = false
 search = `cloudtrail` `ec2_modification_api_calls` errorCode=success | spath output=arn userIdentity.arn | stats earliest(_time) as firstTime latest(_time) as lastTime by arn | outputlookup previously_seen_ec2_modifications_by_user | stats count
 
-[ESCU - Previously Seen Running Windows Services - Baseline]
+[ESCU - Previously Seen Running Windows Services]
 action.escu = 0
 action.escu.enabled = 1
 action.escu.search_type = support
@@ -8261,7 +8613,47 @@ disabled = true
 is_visible = false
 search = `wineventlog_system` signature_id=7036 | rename param1 as service_name | rename param2 as action | search action="running" | stats earliest(_time) as firstTime, latest(_time) as lastTime by service_name | outputlookup previously_seen_running_windows_services | stats count
 
-[ESCU - Previously seen API call per user roles in CloudTrail - Baseline]
+[ESCU - Previously Seen Zoom Child Processes - Initial]
+action.escu = 0
+action.escu.enabled = 1
+action.escu.search_type = support
+action.escu.full_search_name = ESCU - Previously Seen Zoom Child Processes - Initial
+description = This search returns the first and last time a process was seen per endpoint with a parent process of zoom.exe (Windows) or zoom.us (macOS). This table is outputed to disk.
+action.escu.creation_date = 2020-05-20
+action.escu.modification_date = 2020-05-20
+action.escu.analytic_story = ["Suspicious Zoom Child Processes"]
+action.escu.data_models = ["Endpoint"]
+dispatch.earliest_time = -30m
+dispatch.latest_time = now
+schedule_window = auto
+action.escu.providing_technologies = []
+action.escu.eli5 = This search returns the first and last time a process was seen per endpoint with a parent process of zoom.exe (Windows) or zoom.us (macOS). This table is outputed to disk.
+action.escu.how_to_implement = You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints, to populate the Endpoint data model in the Processes node.
+disabled = true
+is_visible = false
+search = | tstats `security_content_summariesonly` min(_time) as firstTimeSeen max(_time) as lastTimeSeen from datamodel=Endpoint.Processes where (Processes.parent_process_name=zoom.exe OR Processes.parent_process_name=zoom.us) by Processes.process_name Processes.dest| `drop_dm_object_name(Processes)` | table dest, process_name, firstTimeSeen, lastTimeSeen | outputlookup zoom_first_time_child_process
+
+[ESCU - Previously Seen Zoom Child Processes - Update]
+action.escu = 0
+action.escu.enabled = 1
+action.escu.search_type = support
+action.escu.full_search_name = ESCU - Previously Seen Zoom Child Processes - Update
+description = This search returns the first and last time a process was seen per endpoint with a parent process of zoom.exe (Windows) or zoom.us (macOS) within the last hour. It then updates this information with historical data and filters out proces_name and endpoint pairs that have not been seen within the specified time window. This updated table is outputed to disk.
+action.escu.creation_date = 2020-05-20
+action.escu.modification_date = 2020-05-20
+action.escu.analytic_story = ["Suspicious Zoom Child Processes"]
+action.escu.data_models = ["Endpoint"]
+dispatch.earliest_time = -30m
+dispatch.latest_time = now
+schedule_window = auto
+action.escu.providing_technologies = []
+action.escu.eli5 = This search returns the first and last time a process was seen per endpoint with a parent process of zoom.exe (Windows) or zoom.us (macOS) within the last hour. It then updates this information with historical data and filters out proces_name and endpoint pairs that have not been seen within the specified time window. This updated table is outputed to disk.
+action.escu.how_to_implement = You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints, to populate the Endpoint data model in the Processes node.
+disabled = true
+is_visible = false
+search = | tstats `security_content_summariesonly` min(_time) as firstTimeSeen max(_time) as lastTimeSeen from datamodel=Endpoint.Processes where (Processes.parent_process_name=zoom.exe OR Processes.parent_process_name=zoom.us) by Processes.process_name Processes.dest| `drop_dm_object_name(Processes)` | table firstTimeSeen, lastTimeSeen, process_name, dest | inputlookup zoom_first_time_child_process append=t | stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by process_name, dest | where lastTimeSeen > relative_time(now(), "`previously_seen_zoom_child_processes_forget_window`") | outputlookup zoom_first_time_child_process
+
+[ESCU - Previously seen API call per user roles in CloudTrail]
 action.escu = 0
 action.escu.enabled = 1
 action.escu.search_type = support
@@ -8281,7 +8673,7 @@ disabled = true
 is_visible = false
 search = `cloudtrail` eventType=AwsApiCall errorCode=success userIdentity.type=AssumedRole | stats earliest(_time) as earliest latest(_time) as latest by userName eventName | outputlookup previously_seen_api_calls_from_user_roles | stats count
 
-[ESCU - Previously seen S3 bucket access by remote IP - Baseline]
+[ESCU - Previously seen S3 bucket access by remote IP]
 action.escu = 0
 action.escu.enabled = 1
 action.escu.search_type = support
@@ -8301,7 +8693,7 @@ disabled = true
 is_visible = false
 search = `aws_s3_accesslogs` http_status=200  | stats  earliest(_time) as earliest latest(_time) as latest by bucket_name remote_ip | outputlookup previously_seen_S3_access_from_remote_ip | stats count
 
-[ESCU - Previously seen command line arguments - Baseline]
+[ESCU - Previously seen command line arguments]
 action.escu = 0
 action.escu.enabled = 1
 action.escu.search_type = support
@@ -8321,7 +8713,7 @@ disabled = true
 is_visible = false
 search = | tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=cmd.exe AND Processes.process="* /c *" by Processes.process | `drop_dm_object_name(Processes)`
 
-[ESCU - Previously seen users in CloudTrail - Baseline]
+[ESCU - Previously seen users in CloudTrail]
 action.escu = 0
 action.escu.enabled = 1
 action.escu.search_type = support
@@ -8341,7 +8733,7 @@ disabled = true
 is_visible = false
 search = `cloudtrail` eventName=ConsoleLogin | rename userIdentity.arn as user | iplocation src | eval City=if(City LIKE "",src,City),Region=if(Region LIKE "",src,Region) | stats earliest(_time) as firstTime latest(_time) as lastTime by user src City Region Country | outputlookup previously_seen_users_console_logins.csv | stats count
 
-[ESCU - Systems Ready for Spectre-Meltdown Windows Patch - Baseline]
+[ESCU - Systems Ready for Spectre-Meltdown Windows Patch]
 action.escu = 0
 action.escu.enabled = 1
 action.escu.search_type = support
@@ -8361,7 +8753,7 @@ disabled = true
 is_visible = false
 search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Change_Analysis.All_Changes where All_Changes.object_category=registry AND (All_Changes.object_path="HKLM\Software\Microsoft\Windows\CurrentVersion\QualityCompat*") by All_Changes.dest, All_Changes.command, All_Changes.user, All_Changes.object, All_Changes.object_path | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name("All_Changes")`
 
-[ESCU - Update previously seen users in CloudTrail - Baseline]
+[ESCU - Update previously seen users in CloudTrail]
 action.escu = 0
 action.escu.enabled = 1
 action.escu.search_type = support
@@ -8381,7 +8773,7 @@ disabled = true
 is_visible = false
 search = `cloudtrail` eventName=ConsoleLogin | rename userIdentity.arn as user | iplocation src | eval City=if(City LIKE "",src,City),Region=if(Region LIKE "",src,Region) | stats earliest(_time) AS firstTime latest(_time) AS lastTime by user src City Region Country | inputlookup append=t previously_seen_users_console_logins.csv | stats min(firstTime) as firstTime max(lastTime) as lastTime by user src City Region Country | outputlookup previously_seen_users_console_logins.csv
 
-[ESCU - Windows Updates Install Failures - Baseline]
+[ESCU - Windows Updates Install Failures]
 action.escu = 0
 action.escu.enabled = 1
 action.escu.search_type = support
@@ -8401,7 +8793,7 @@ disabled = true
 is_visible = false
 search = | tstats `security_content_summariesonly` dc(Updates.dest) as count FROM datamodel=Updates where Updates.vendor_product="Microsoft Windows" AND Updates.status=failure by _time span=1d
 
-[ESCU - Windows Updates Install Successes - Baseline]
+[ESCU - Windows Updates Install Successes]
 action.escu = 0
 action.escu.enabled = 1
 action.escu.search_type = support
@@ -8706,7 +9098,7 @@ action.escu.full_search_name = ESCU - Get Authentication Logs For Endpoint
 description = This search returns all users that have attempted to access a particular endpoint.
 action.escu.creation_date = 2017-11-01
 action.escu.modification_date = 2017-11-01
-action.escu.analytic_story = ["AWS Network ACL Activity", "Account Monitoring and Controls", "Apache Struts Vulnerability", "Brand Monitoring", "ColdRoot MacOS RAT", "Collection and Staging", "Command and Control", "DHS Report TA18-074A", "Data Protection", "Disabling Security Tools", "Dynamic DNS", "Emotet Malware  DHS Report TA18-201A ", "Hidden Cobra Malware", "Host Redirection", "Lateral Movement", "Malicious PowerShell", "Monitor for Unauthorized Software", "Netsh Abuse", "Orangeworm Attack Group", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "Router and Infrastructure Security", "SQL Injection", "SamSam Ransomware", "Spectre And Meltdown Vulnerabilities", "Suspicious AWS Traffic", "Suspicious Command-Line Executions", "Suspicious DNS Traffic", "Suspicious Emails", "Suspicious MSHTA Activity", "Suspicious WMI Use", "Suspicious Windows Registry Activities", "Unusual Processes", "Windows Defense Evasion Tactics", "Windows File Extension and Association Abuse", "Windows Log Manipulation", "Windows Persistence Techniques", "Windows Privilege Escalation", "Windows Service Abuse"]
+action.escu.analytic_story = ["AWS Network ACL Activity", "Account Monitoring and Controls", "Apache Struts Vulnerability", "Brand Monitoring", "ColdRoot MacOS RAT", "Collection and Staging", "Command and Control", "DHS Report TA18-074A", "Data Protection", "Disabling Security Tools", "Dynamic DNS", "Emotet Malware  DHS Report TA18-201A ", "Hidden Cobra Malware", "Host Redirection", "Lateral Movement", "Malicious PowerShell", "Monitor for Unauthorized Software", "Netsh Abuse", "Orangeworm Attack Group", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "Router and Infrastructure Security", "SQL Injection", "SamSam Ransomware", "Spectre And Meltdown Vulnerabilities", "Suspicious AWS Traffic", "Suspicious Command-Line Executions", "Suspicious DNS Traffic", "Suspicious Emails", "Suspicious MSHTA Activity", "Suspicious WMI Use", "Suspicious Windows Registry Activities", "Unusual Processes", "Windows Defense Evasion Tactics", "Windows File Extension and Association Abuse", "Windows Log Manipulation", "Windows Persistence Techniques", "Windows Privilege Escalation", "Windows Service Abuse", "Suspicious Zoom Child Processes"]
 action.escu.earliest_time_offset = 3600
 action.escu.latest_time_offset = 86400
 action.escu.providing_technologies = []
@@ -9000,7 +9392,7 @@ action.escu.full_search_name = ESCU - Get Notable Info
 description = This search queries the notable index to retrieve detailed information captured within the notable. Every notable has a unique ID associated with it, which is used to point us directly to the notable event under investigation.
 action.escu.creation_date = 2017-09-20
 action.escu.modification_date = 2017-09-20
-action.escu.analytic_story = ["AWS Cryptomining", "AWS Network ACL Activity", "AWS User Monitoring", "Account Monitoring and Controls", "Apache Struts Vulnerability", "Asset Tracking", "Brand Monitoring", "Cloud Cryptomining", "Collection and Staging", "Command and Control", "DHS Report TA18-074A", "DNS Amplification Attacks", "Data Protection", "Disabling Security Tools", "Dynamic DNS", "Emotet Malware  DHS Report TA18-201A ", "Hidden Cobra Malware", "Host Redirection", "JBoss Vulnerability", "Kubernetes Scanning Activity", "Lateral Movement", "Malicious PowerShell", "Monitor for Unauthorized Software", "Monitor for Updates", "Netsh Abuse", "Orangeworm Attack Group", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "Router and Infrastructure Security", "SQL Injection", "SamSam Ransomware", "Spectre And Meltdown Vulnerabilities", "Splunk Enterprise Vulnerability", "Splunk Enterprise Vulnerability CVE-2018-11409", "Suspicious AWS EC2 Activities", "Suspicious AWS S3 Activities", "Suspicious AWS Traffic", "Suspicious Command-Line Executions", "Suspicious DNS Traffic", "Suspicious Emails", "Suspicious MSHTA Activity", "Suspicious WMI Use", "Suspicious Windows Registry Activities", "Unusual Processes", "Use of Cleartext Protocols", "Web Fraud Detection", "Windows Defense Evasion Tactics", "Windows File Extension and Association Abuse", "Windows Log Manipulation", "Windows Persistence Techniques", "Windows Privilege Escalation", "Windows Service Abuse"]
+action.escu.analytic_story = ["AWS Cryptomining", "AWS Network ACL Activity", "AWS User Monitoring", "Account Monitoring and Controls", "Apache Struts Vulnerability", "Asset Tracking", "Brand Monitoring", "Cloud Cryptomining", "Collection and Staging", "Command and Control", "DHS Report TA18-074A", "DNS Amplification Attacks", "Data Protection", "Disabling Security Tools", "Dynamic DNS", "Emotet Malware  DHS Report TA18-201A ", "Hidden Cobra Malware", "Host Redirection", "JBoss Vulnerability", "Kubernetes Scanning Activity", "Lateral Movement", "Malicious PowerShell", "Monitor for Unauthorized Software", "Monitor for Updates", "Netsh Abuse", "Orangeworm Attack Group", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "Router and Infrastructure Security", "SQL Injection", "SamSam Ransomware", "Spectre And Meltdown Vulnerabilities", "Splunk Enterprise Vulnerability", "Splunk Enterprise Vulnerability CVE-2018-11409", "Suspicious AWS EC2 Activities", "Suspicious AWS S3 Activities", "Suspicious AWS Traffic", "Suspicious Command-Line Executions", "Suspicious DNS Traffic", "Suspicious Emails", "Suspicious MSHTA Activity", "Suspicious WMI Use", "Suspicious Windows Registry Activities", "Unusual Processes", "Use of Cleartext Protocols", "Web Fraud Detection", "Windows Defense Evasion Tactics", "Windows File Extension and Association Abuse", "Windows Log Manipulation", "Windows Persistence Techniques", "Windows Privilege Escalation", "Windows Service Abuse", "Kubernetes Sensitive Role Activity", "Kubernetes Sensitive Object Access Activity"]
 action.escu.earliest_time_offset = 3600
 action.escu.latest_time_offset = 86400
 action.escu.providing_technologies = []
@@ -9063,7 +9455,7 @@ action.escu.full_search_name = ESCU - Get Process File Activity
 description = This search returns the file activity for a specific process on a specific endpoint
 action.escu.creation_date = 2019-11-06
 action.escu.modification_date = 2019-11-06
-action.escu.analytic_story = ["DHS Report TA18-074A"]
+action.escu.analytic_story = ["DHS Report TA18-074A", "Suspicious Zoom Child Processes"]
 action.escu.earliest_time_offset = 3600
 action.escu.latest_time_offset = 86400
 action.escu.providing_technologies = []
@@ -9126,7 +9518,7 @@ action.escu.full_search_name = ESCU - Get Process Registry Activity
 description = This search returns the registry activity for a specific process on a specific endpoint
 action.escu.creation_date = 2019-11-06
 action.escu.modification_date = 2019-11-06
-action.escu.analytic_story = ["DHS Report TA18-074A"]
+action.escu.analytic_story = ["DHS Report TA18-074A", "Suspicious Zoom Child Processes"]
 action.escu.earliest_time_offset = 3600
 action.escu.latest_time_offset = 86400
 action.escu.providing_technologies = []

package/default/transforms.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security-content
-# On Date: 2020-05-25T14:45:46 UTC
+# On Date: 2020-06-04T22:46:46 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -200,3 +200,9 @@ default_match = false
 match_type = WILDCARD(file)
 min_matches = 1
 
+[zoom_first_time_child_process]
+collection = zoom_first_time_child_process
+external_type = kvstore
+# description = A list of suspicious file names
+fields_list = _key, dest, process_name, firstTimeSeen, lastTimeSeen
+

package/lookups/mitre_enrichment.csv

@@ -0,0 +1,267 @@
+mitre_id,technique,tactics,groups
+T1531,Account Access Removal,Impact,no
+T1506,Web Session Cookie,Defense Evasion|Lateral Movement,no
+T1539,Steal Web Session Cookie,Credential Access,no
+T1529,System Shutdown/Reboot,Impact,Lazarus Group|APT38|APT37
+T1519,Emond,Persistence|Privilege Escalation,no
+T1518,Software Discovery,Discovery,no
+T1534,Internal Spearphishing,Lateral Movement,no
+T1528,Steal Application Access Token,Credential Access,APT28
+T1522,Cloud Instance Metadata API,Credential Access,no
+T1536,Revert Cloud Instance,Defense Evasion,no
+T1535,Unused/Unsupported Cloud Regions,Defense Evasion,no
+T1525,Implant Container Image,Persistence,no
+T1538,Cloud Service Dashboard,Discovery,no
+T1530,Data from Cloud Storage Object,Collection,no
+T1537,Transfer Data to Cloud Account,Exfiltration,no
+T1526,Cloud Service Discovery,Discovery,no
+T1527,Application Access Token,Defense Evasion|Lateral Movement,APT28
+T1514,Elevated Execution with Prompt,Privilege Escalation,no
+T1505,Server Software Component,Persistence,no
+T1503,Credentials from Web Browsers,Credential Access,TA505|Stolen Pencil|MuddyWater
+T1504,PowerShell Profile,Persistence|Privilege Escalation,Turla
+T1502,Parent PID Spoofing,Defense Evasion|Privilege Escalation,no
+T1500,Compile After Delivery,Defense Evasion,MuddyWater
+T1501,Systemd Service,Persistence,no
+T1499,Endpoint Denial of Service,Impact,no
+T1497,Virtualization/Sandbox Evasion,Defense Evasion|Discovery,The White Company|FIN7
+T1498,Network Denial of Service,Impact,no
+T1496,Resource Hijacking,Impact,APT41|Lazarus Group
+T1495,Firmware Corruption,Impact,no
+T1494,Runtime Data Manipulation,Impact,APT38
+T1493,Transmitted Data Manipulation,Impact,APT38
+T1492,Stored Data Manipulation,Impact,FIN4|APT38
+T1491,Defacement,Impact,no
+T1490,Inhibit System Recovery,Impact,no
+T1489,Service Stop,Impact,Lazarus Group
+T1488,Disk Content Wipe,Impact,Lazarus Group
+T1487,Disk Structure Wipe,Impact,Lazarus Group|APT38|APT37
+T1486,Data Encrypted for Impact,Impact,APT41|TA505|APT38
+T1485,Data Destruction,Impact,Lazarus Group|APT38
+T1484,Group Policy Modification,Defense Evasion,no
+T1483,Domain Generation Algorithms,Command And Control,APT41
+T1482,Domain Trust Discovery,Discovery,no
+T1480,Execution Guardrails,Defense Evasion,APT33|Equation
+T1223,Compiled HTML File,Defense Evasion|Execution,APT41|Silence|Lazarus Group|Dark Caracal|OilRig
+T1222,File and Directory Permissions Modification,Defense Evasion,APT32
+T1220,XSL Script Processing,Defense Evasion|Execution,Cobalt Group
+T1221,Template Injection,Defense Evasion,APT28|Tropic Trooper|Dragonfly 2.0|DarkHydrus
+T1197,BITS Jobs,Defense Evasion|Persistence,Leviathan
+T1217,Browser Bookmark Discovery,Discovery,no
+T1191,CMSTP,Defense Evasion|Execution,Cobalt Group|MuddyWater
+T1196,Control Panel Items,Defense Evasion|Execution,no
+T1214,Credentials in Registry,Credential Access,Soft Cell
+T1207,DCShadow,Defense Evasion,no
+T1213,Data from Information Repositories,Collection,Ke3chang|APT28
+T1212,Exploitation for Credential Access,Credential Access,no
+T1190,Exploit Public-Facing Application,Initial Access,Soft Cell|Night Dragon|Axiom
+T1210,Exploitation of Remote Services,Lateral Movement,Threat Group-3390|APT28
+T1189,Drive-by Compromise,Initial Access,Darkhotel|APT38|Lazarus Group|Dragonfly 2.0|Leafminer|BRONZE BUTLER|Dark Caracal|Threat Group-3390|APT32|APT19|Elderwood|Patchwork|APT37|PLATINUM
+T1211,Exploitation for Defense Evasion,Defense Evasion,APT28
+T1203,Exploitation for Client Execution,Execution,APT41|admin@338|Threat Group-3390|APT12|The White Company|APT33|APT32|APT28|Tropic Trooper|BRONZE BUTLER|Lazarus Group|Cobalt Group|APT37|APT29|Patchwork|Leviathan|Elderwood|TA459
+T1215,Kernel Modules and Extensions,Persistence,no
+T1200,Hardware Additions,Initial Access,no
+T1208,Kerberoasting,Credential Access,no
+T1202,Indirect Command Execution,Defense Evasion,no
+T1201,Password Policy Discovery,Discovery,OilRig
+T1205,Port Knocking,Defense Evasion|Persistence|Command And Control,no
+T1198,SIP and Trust Provider Hijacking,Defense Evasion|Persistence,no
+T1218,Signed Binary Proxy Execution,Defense Evasion|Execution,TA505|Rancor|Cobalt Group
+T1194,Spearphishing via Service,Initial Access,FIN6|OilRig|Dark Caracal|Magic Hound
+T1192,Spearphishing Link,Initial Access,Machete|Kimsuky|TA505|Stolen Pencil|APT39|FIN4|APT32|Night Dragon|APT28|Turla|Cobalt Group|Dragonfly 2.0|OilRig|APT33|Elderwood|Patchwork|APT29|Leviathan|Magic Hound|FIN8
+T1195,Supply Chain Compromise,Initial Access,APT41|Elderwood
+T1219,Remote Access Tools,Command And Control,Kimsuky|Night Dragon|Thrip|Cobalt Group|Carbanak
+T1206,Sudo Caching,Privilege Escalation,no
+T1199,Trusted Relationship,Initial Access,APT28|menuPass
+T1216,Signed Script Proxy Execution,Defense Evasion|Execution,APT32
+T1193,Spearphishing Attachment,Initial Access,APT41|Machete|admin@338|Kimsuky|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|Tropic Trooper|Turla|Gorgon Group|Rancor|DarkHydrus|Lazarus Group|OilRig|Cobalt Group|FIN7|BRONZE BUTLER|APT19|Dragonfly 2.0|APT32|FIN8|MuddyWater|APT28|TA459|Elderwood|APT37|APT29|Patchwork|Leviathan|Magic Hound|menuPass|PLATINUM
+T1209,Time Providers,Persistence,no
+T1204,User Execution,Execution,Machete|admin@338|APT12|TA505|Silence|The White Company|APT39|FIN4|Night Dragon|Darkhotel|Gallmaker|Dragonfly 2.0|APT33|APT19|BRONZE BUTLER|Dark Caracal|Cobalt Group|FIN7|DarkHydrus|Turla|Gorgon Group|Patchwork|OilRig|Lazarus Group|APT32|MuddyWater|Rancor|APT37|APT28|APT29|menuPass|FIN8|TA459|Elderwood|Magic Hound|Leviathan|PLATINUM
+T1182,AppCert DLLs,Persistence|Privilege Escalation,Honeybee
+T1176,Browser Extensions,Persistence,Kimsuky|Stolen Pencil
+T1175,Component Object Model and Distributed COM,Lateral Movement|Execution,MuddyWater
+T1172,Domain Fronting,Command And Control,APT29
+T1181,Extra Window Memory Injection,Defense Evasion|Privilege Escalation,no
+T1173,Dynamic Data Exchange,Execution,TA505|MuddyWater|Gallmaker|Patchwork|Cobalt Group|APT37|APT28|FIN7
+T1187,Forced Authentication,Credential Access,DarkHydrus|Dragonfly 2.0
+T1179,Hooking,Persistence|Privilege Escalation|Credential Access,PLATINUM
+T1177,LSASS Driver,Execution|Persistence,no
+T1188,Multi-hop Proxy,Command And Control,FIN4|APT29
+T1183,Image File Execution Options Injection,Privilege Escalation|Persistence|Defense Evasion,TEMP.Veles
+T1171,LLMNR/NBT-NS Poisoning and Relay,Credential Access,no
+T1185,Man in the Browser,Collection,no
+T1170,Mshta,Defense Evasion|Execution,Kimsuky|APT32|MuddyWater|FIN7
+T1180,Screensaver,Persistence,no
+T1174,Password Filter DLL,Credential Access,no
+T1184,SSH Hijacking,Lateral Movement,no
+T1178,SID-History Injection,Privilege Escalation,no
+T1186,Process Doppelgänging,Defense Evasion,no
+T1156,.bash_profile and .bashrc,Persistence,no
+T1134,Access Token Manipulation,Defense Evasion|Privilege Escalation,Turla|Lazarus Group|APT28
+T1155,AppleScript,Execution|Lateral Movement,no
+T1138,Application Shimming,Persistence|Privilege Escalation,FIN7
+T1139,Bash History,Credential Access,no
+T1146,Clear Command History,Defense Evasion,APT41
+T1136,Create Account,Persistence,APT41|Soft Cell|Dragonfly 2.0|Leafminer|APT3
+T1140,Deobfuscate/Decode Files or Information,Defense Evasion,Turla|WIRTE|Darkhotel|Tropic Trooper|Honeybee|menuPass|Gorgon Group|Threat Group-3390|APT19|Leviathan|MuddyWater|APT28|OilRig|BRONZE BUTLER
+T1157,Dylib Hijacking,Persistence|Privilege Escalation,no
+T1148,HISTCONTROL,Defense Evasion,no
+T1147,Hidden Users,Defense Evasion,no
+T1143,Hidden Window,Defense Evasion,Gorgon Group|Deep Panda|DarkHydrus|CopyKittens|APT19|APT32|APT28|APT3|Magic Hound
+T1141,Input Prompt,Credential Access,FIN4
+T1149,LC_MAIN Hijacking,Defense Evasion,no
+T1152,Launchctl,Defense Evasion|Execution|Persistence,no
+T1162,Login Item,Persistence,no
+T1137,Office Application Startup,Persistence,APT32|APT28
+T1144,Gatekeeper Bypass,Defense Evasion,no
+T1158,Hidden Files and Directories,Defense Evasion|Persistence,APT32|Tropic Trooper|APT28|Lazarus Group
+T1161,LC_LOAD_DYLIB Addition,Persistence,no
+T1168,Local Job Scheduling,Persistence|Execution,no
+T1160,Launch Daemon,Persistence|Privilege Escalation,no
+T1142,Keychain,Credential Access,no
+T1159,Launch Agent,Persistence,no
+T1163,Rc.common,Persistence,no
+T1135,Network Share Discovery,Discovery,APT41|Tropic Trooper|APT1|Dragonfly 2.0|Sowbug
+T1151,Space after Filename,Defense Evasion|Execution,no
+T1150,Plist Modification,Defense Evasion|Persistence|Privilege Escalation,no
+T1145,Private Keys,Credential Access,no
+T1167,Securityd Memory,Credential Access,no
+T1166,Setuid and Setgid,Privilege Escalation|Persistence,no
+T1153,Source,Execution,no
+T1164,Re-opened Applications,Persistence,no
+T1154,Trap,Execution|Persistence,no
+T1165,Startup Items,Persistence|Privilege Escalation,no
+T1169,Sudo,Privilege Escalation,no
+T1133,External Remote Services,Persistence|Initial Access,APT41|Soft Cell|TEMP.Veles|Night Dragon|OilRig|Ke3chang|Dragonfly 2.0|FIN5|Threat Group-3390|APT18
+T1132,Data Encoding,Command And Control,APT33|APT19|Lazarus Group|BRONZE BUTLER|Patchwork
+T1131,Authentication Package,Persistence,no
+T1130,Install Root Certificate,Defense Evasion,no
+T1129,Execution through Module Load,Execution,no
+T1128,Netsh Helper DLL,Persistence,no
+T1127,Trusted Developer Utilities,Defense Evasion|Execution,no
+T1126,Network Share Connection Removal,Defense Evasion,Threat Group-3390
+T1125,Video Capture,Collection,Silence|FIN7
+T1124,System Time Discovery,Discovery,The White Company|Lazarus Group|BRONZE BUTLER|Turla
+T1123,Audio Capture,Collection,APT37
+T1122,Component Object Model Hijacking,Defense Evasion|Persistence,APT28
+T1121,Regsvcs/Regasm,Defense Evasion|Execution,no
+T1120,Peripheral Device Discovery,Discovery,APT37|Gamaredon Group|Equation|APT28
+T1119,Automated Collection,Collection,APT1|APT28|Patchwork|OilRig|FIN5|Threat Group-3390|FIN6
+T1118,InstallUtil,Defense Evasion|Execution,no
+T1117,Regsvr32,Defense Evasion|Execution,WIRTE|APT19|Cobalt Group|Leviathan|APT32|Deep Panda
+T1116,Code Signing,Defense Evasion,APT41|FIN6|TA505|FIN7|Honeybee|APT37|Leviathan|CopyKittens|Winnti Group|Suckfly|Molerats|Darkhotel
+T1115,Clipboard Data,Collection,APT38
+T1114,Email Collection,Collection,FIN4|APT28|Dragonfly 2.0|Magic Hound|Ke3chang|Leafminer|APT1
+T1113,Screen Capture,Collection,Silence|MuddyWater|OilRig|Dragonfly 2.0|Dark Caracal|FIN7|BRONZE BUTLER|Magic Hound|Group5|APT28
+T1112,Modify Registry,Defense Evasion,APT41|Turla|APT32|APT38|Dragonfly 2.0|APT19|Patchwork|Threat Group-3390|Honeybee|Gorgon Group|FIN8
+T1111,Two-Factor Authentication Interception,Credential Access,no
+T1110,Brute Force,Credential Access,APT41|APT33|Leafminer|OilRig|Dragonfly 2.0|APT3|Lazarus Group|Turla
+T1109,Component Firmware,Defense Evasion|Persistence,Equation
+T1108,Redundant Access,Defense Evasion|Persistence,Stolen Pencil|Cobalt Group|Leafminer|APT3|FIN5|OilRig|Threat Group-3390
+T1107,File Deletion,Defense Evasion,APT41|Kimsuky|Silence|The White Company|TEMP.Veles|APT32|APT38|Honeybee|Patchwork|Cobalt Group|Dragonfly 2.0|menuPass|FIN8|OilRig|FIN5|BRONZE BUTLER|Magic Hound|APT3|FIN10|APT28|Threat Group-3390|Group5|Lazarus Group|APT18|APT29
+T1106,Execution through API,Execution,Turla|Silence|APT37|Gorgon Group
+T1105,Remote File Copy,Command And Control|Lateral Movement,Soft Cell|TA505|WIRTE|APT33|MuddyWater|APT18|APT38|Turla|Rancor|Cobalt Group|Gorgon Group|Dragonfly 2.0|OilRig|APT37|FIN8|Leviathan|PLATINUM|Elderwood|Magic Hound|APT3|BRONZE BUTLER|APT32|FIN7|menuPass|FIN10|Gamaredon Group|Patchwork|Lazarus Group|Threat Group-3390|APT28
+T1104,Multi-Stage Channels,Command And Control,MuddyWater|APT3
+T1103,AppInit DLLs,Persistence|Privilege Escalation,no
+T1102,Web Service,Command And Control|Defense Evasion,APT41|APT12|FIN6|Turla|FIN7|BRONZE BUTLER|Leviathan|APT37|Magic Hound|RTM|Patchwork|Carbanak
+T1101,Security Support Provider,Persistence,no
+T1100,Web Shell,Persistence|Privilege Escalation,Soft Cell|Threat Group-3390|TEMP.Veles|Leviathan|APT39|Dragonfly 2.0|APT32|OilRig|Deep Panda
+T1099,Timestomp,Defense Evasion,TEMP.Veles|APT32|Lazarus Group|APT28
+T1098,Account Manipulation,Credential Access|Persistence,Magic Hound|Dragonfly 2.0|APT3|Lazarus Group
+T1097,Pass the Ticket,Lateral Movement,APT32|Ke3chang|BRONZE BUTLER|APT29
+T1096,NTFS File Attributes,Defense Evasion,APT32
+T1095,Standard Non-Application Layer Protocol,Command And Control,APT29|PLATINUM|APT3
+T1094,Custom Command and Control Protocol,Command And Control,PLATINUM|APT37|OilRig|APT32
+T1093,Process Hollowing,Defense Evasion,menuPass|Gorgon Group|Patchwork
+T1092,Communication Through Removable Media,Command And Control,APT28
+T1091,Replication Through Removable Media,Lateral Movement|Initial Access,Darkhotel|APT28
+T1090,Connection Proxy,Command And Control|Defense Evasion,APT41|Soft Cell|Turla|APT39|MuddyWater|APT3|Lazarus Group|menuPass|Strider|APT28
+T1089,Disabling Security Tools,Defense Evasion,Kimsuky|Turla|Night Dragon|Dragonfly 2.0|Gorgon Group|Threat Group-3390|Lazarus Group|Putter Panda|Carbanak
+T1088,Bypass User Account Control,Defense Evasion|Privilege Escalation,APT37|MuddyWater|Honeybee|Threat Group-3390|Cobalt Group|BRONZE BUTLER|Patchwork|APT29
+T1087,Account Discovery,Discovery,APT32|APT1|Dragonfly 2.0|BRONZE BUTLER|OilRig|Threat Group-3390|menuPass|FIN6|Poseidon Group|APT3|admin@338|Ke3chang
+T1086,PowerShell,Execution,APT41|Kimsuky|Soft Cell|TA505|WIRTE|TEMP.Veles|APT33|Gallmaker|Turla|APT19|DarkHydrus|APT28|Thrip|Dragonfly 2.0|Cobalt Group|Gorgon Group|Leviathan|TA459|FIN8|MuddyWater|CopyKittens|OilRig|Magic Hound|BRONZE BUTLER|APT32|FIN10|FIN7|Threat Group-3390|menuPass|Patchwork|Stealth Falcon|FIN6|Poseidon Group|APT3|APT29|Deep Panda
+T1085,Rundll32,Defense Evasion|Execution,TA505|MuddyWater|APT29|APT19|CopyKittens|APT3|Carbanak|APT28
+T1084,Windows Management Instrumentation Event Subscription,Persistence,Turla|Leviathan|APT29
+T1083,File and Directory Discovery,Discovery,Kimsuky|APT32|MuddyWater|APT18|Leafminer|Dragonfly 2.0|Dark Caracal|Honeybee|Magic Hound|APT3|Sowbug|BRONZE BUTLER|APT28|Patchwork|Lazarus Group|Dust Storm|admin@338|Turla|Ke3chang
+T1082,System Information Discovery,Discovery,Kimsuky|Tropic Trooper|Darkhotel|MuddyWater|APT18|APT37|APT19|Honeybee|APT32|OilRig|Magic Hound|APT3|Sowbug|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|admin@338|Turla|Ke3chang
+T1081,Credentials in Files,Credential Access,OilRig|Kimsuky|Turla|TA505|Stolen Pencil|MuddyWater|APT3
+T1080,Taint Shared Content,Lateral Movement,Darkhotel
+T1079,Multilayer Encryption,Command And Control,no
+T1078,Valid Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,APT41|Soft Cell|TEMP.Veles|APT39|Stolen Pencil|FIN4|Night Dragon|Dragonfly 2.0|FIN8|APT33|Leviathan|APT3|FIN5|OilRig|menuPass|APT28|FIN10|APT32|Suckfly|FIN6|Threat Group-1314|Threat Group-3390|APT18|PittyTiger|Carbanak
+T1077,Windows Admin Shares,Lateral Movement,APT32|Orangeworm|FIN8|APT3|Lazarus Group|Threat Group-1314|Turla|Deep Panda|Ke3chang
+T1076,Remote Desktop Protocol,Lateral Movement,APT41|TEMP.Veles|Leviathan|APT39|Stolen Pencil|Cobalt Group|Dragonfly 2.0|FIN8|APT3|OilRig|menuPass|FIN10|Patchwork|FIN6|Lazarus Group|APT1|Axiom
+T1075,Pass the Hash,Lateral Movement,Soft Cell|APT32|Night Dragon|APT28|APT1
+T1074,Data Staged,Collection,Machete|Soft Cell|TEMP.Veles|Night Dragon|Honeybee|Patchwork|Dragonfly 2.0|Leviathan|FIN8|APT3|FIN5|menuPass|FIN6|Lazarus Group|Threat Group-3390|APT28
+T1073,DLL Side-Loading,Defense Evasion,APT41|Soft Cell|Tropic Trooper|Patchwork|APT19|APT32|APT3|menuPass|Threat Group-3390
+T1072,Third-party Software,Execution|Lateral Movement,Threat Group-1314
+T1071,Standard Application Layer Protocol,Command And Control,APT41|Machete|WIRTE|APT33|FIN4|Night Dragon|APT18|SilverTerrier|APT38|Dragonfly 2.0|APT19|Cobalt Group|FIN7|Threat Group-3390|APT37|Rancor|Orangeworm|Turla|Honeybee|Ke3chang|Dark Caracal|Lazarus Group|BRONZE BUTLER|OilRig|APT32|Magic Hound|Gamaredon Group|Stealth Falcon|FIN6|APT28
+T1070,Indicator Removal on Host,Defense Evasion,APT41|APT29|APT38|Dragonfly 2.0|APT32|FIN8|FIN5|APT28
+T1069,Permission Groups Discovery,Discovery,FIN6|Dragonfly 2.0|OilRig|APT3|admin@338|Ke3chang
+T1068,Exploitation for Privilege Escalation,Privilege Escalation,APT33|Cobalt Group|PLATINUM|FIN8|APT32|Threat Group-3390|FIN6|APT28
+T1067,Bootkit,Persistence,APT41|Lazarus Group|APT28
+T1066,Indicator Removal from Tools,Defense Evasion,Soft Cell|TEMP.Veles|Patchwork|APT3|Turla|OilRig|Deep Panda
+T1065,Uncommonly Used Port,Command And Control,TEMP.Veles|APT33|APT32|Gorgon Group|Magic Hound|Group5|Lazarus Group|APT3
+T1064,Scripting,Defense Evasion|Execution,Machete|Turla|TA505|Silence|WIRTE|APT39|FIN4|APT32|Darkhotel|Gallmaker|Dark Caracal|Lazarus Group|menuPass|APT19|Dragonfly 2.0|Leafminer|Rancor|Honeybee|Cobalt Group|APT37|Ke3chang|FIN7|Gorgon Group|Patchwork|MuddyWater|Leviathan|FIN8|TA459|APT28|Magic Hound|OilRig|BRONZE BUTLER|FIN5|FIN10|Gamaredon Group|Stealth Falcon|FIN6|APT3|APT29|Deep Panda|APT1
+T1063,Security Software Discovery,Discovery,The White Company|Cobalt Group|Darkhotel|MuddyWater|Tropic Trooper|FIN8|Patchwork|Naikon
+T1062,Hypervisor,Persistence,no
+T1061,Graphical User Interface,Execution,APT3
+T1060,Registry Run Keys / Startup Folder,Persistence,APT41|Machete|Kimsuky|APT33|APT39|APT32|APT18|Turla|APT19|Cobalt Group|Honeybee|Dark Caracal|Ke3chang|Threat Group-3390|Dragonfly 2.0|Gorgon Group|MuddyWater|APT37|Leviathan|BRONZE BUTLER|APT3|Magic Hound|FIN10|FIN7|Patchwork|FIN6|Lazarus Group|Putter Panda|APT29|Darkhotel
+T1059,Command-Line Interface,Execution,APT41|Soft Cell|Turla|Silence|APT32|Cobalt Group|MuddyWater|APT18|APT38|Dragonfly 2.0|Gorgon Group|APT28|FIN7|Rancor|Honeybee|Leviathan|APT37|FIN8|Magic Hound|Sowbug|OilRig|BRONZE BUTLER|menuPass|Threat Group-3390|Suckfly|Patchwork|Lazarus Group|Threat Group-1314|APT3|admin@338|APT1|Ke3chang
+T1058,Service Registry Permissions Weakness,Persistence|Privilege Escalation,no
+T1057,Process Discovery,Discovery,Darkhotel|MuddyWater|APT1|APT38|Tropic Trooper|APT37|Honeybee|OilRig|APT3|Magic Hound|APT28|Winnti Group|Stealth Falcon|Poseidon Group|Lazarus Group|Molerats|Turla|Deep Panda|Ke3chang
+T1056,Input Capture,Collection|Credential Access,APT41|Kimsuky|menuPass|Stolen Pencil|FIN4|APT38|OilRig|Ke3chang|PLATINUM|Sowbug|Magic Hound|Group5|Lazarus Group|Threat Group-3390|APT3|Darkhotel|APT28
+T1055,Process Injection,Defense Evasion|Privilege Escalation,APT41|Kimsuky|Tropic Trooper|Gorgon Group|Turla|Threat Group-3390|APT37|Cobalt Group|Honeybee|Lazarus Group|PLATINUM|Putter Panda
+T1054,Indicator Blocking,Defense Evasion,no
+T1053,Scheduled Task,Execution|Persistence|Privilege Escalation,APT41|Machete|Soft Cell|Silence|TEMP.Veles|APT33|APT39|Cobalt Group|Dragonfly 2.0|Patchwork|OilRig|Rancor|FIN8|BRONZE BUTLER|menuPass|FIN10|APT32|FIN7|Stealth Falcon|FIN6|Threat Group-3390|APT18|APT3|APT29
+T1052,Exfiltration Over Physical Medium,Exfiltration,no
+T1051,Shared Webroot,Lateral Movement,no
+T1050,New Service,Persistence|Privilege Escalation,Kimsuky|Tropic Trooper|Cobalt Group|Ke3chang|FIN7|APT32|Threat Group-3390|APT3|Lazarus Group|Carbanak
+T1049,System Network Connections Discovery,Discovery,APT41|APT38|Soft Cell|APT32|APT1|OilRig|APT3|menuPass|Threat Group-3390|Poseidon Group|admin@338|Turla|Ke3chang
+T1048,Exfiltration Over Alternative Protocol,Exfiltration,Turla|APT33|Thrip|FIN8|OilRig|Lazarus Group
+T1047,Windows Management Instrumentation,Execution,APT41|FIN6|Soft Cell|APT32|MuddyWater|OilRig|Threat Group-3390|Leviathan|FIN8|menuPass|Stealth Falcon|Lazarus Group|APT29|Deep Panda
+T1046,Network Service Scanning,Discovery,APT41|Tropic Trooper|APT39|APT32|Leafminer|Cobalt Group|OilRig|menuPass|Suckfly|FIN6|Threat Group-3390
+T1045,Software Packing,Defense Evasion,Soft Cell|The White Company|APT39|APT38|Dark Caracal|Elderwood|APT3|Group5|Patchwork|APT29|Night Dragon
+T1044,File System Permissions Weakness,Persistence|Privilege Escalation,no
+T1043,Commonly Used Port,Command And Control,Machete|OilRig|APT28|TEMP.Veles|APT33|APT32|Night Dragon|APT29|APT18|Tropic Trooper|APT19|FIN7|Dragonfly 2.0|FIN8|APT37|Magic Hound|APT3|Lazarus Group|Threat Group-3390
+T1042,Change Default File Association,Persistence,Kimsuky
+T1041,Exfiltration Over Command and Control Channel,Exfiltration,Kimsuky|Soft Cell|APT32|APT3|Gamaredon Group|Stealth Falcon|Lazarus Group|Ke3chang
+T1040,Network Sniffing,Credential Access|Discovery,APT33|Stolen Pencil|APT28
+T1039,Data from Network Shared Drive,Collection,Sowbug|BRONZE BUTLER|menuPass
+T1038,DLL Search Order Hijacking,Persistence|Privilege Escalation|Defense Evasion,Threat Group-3390|menuPass
+T1037,Logon Scripts,Lateral Movement|Persistence,Cobalt Group|APT28
+T1036,Masquerading,Defense Evasion,APT41|Soft Cell|PLATINUM|Ke3chang|Scarlet Mimic|menuPass|FIN6|TEMP.Veles|Dragonfly 2.0|MuddyWater|BRONZE BUTLER|Sowbug|FIN7|APT32|Patchwork|Poseidon Group|admin@338|Carbanak|APT1
+T1035,Service Execution,Execution,Silence|FIN6|APT32|Honeybee|Ke3chang
+T1034,Path Interception,Persistence|Privilege Escalation,no
+T1033,System Owner/User Discovery,Discovery,APT41|Soft Cell|Tropic Trooper|APT39|MuddyWater|APT32|APT37|APT19|Dragonfly 2.0|Magic Hound|OilRig|FIN10|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|APT3
+T1032,Standard Cryptographic Protocol,Command And Control,Machete|APT33|Tropic Trooper|Cobalt Group|OilRig|FIN8|BRONZE BUTLER|Stealth Falcon|FIN6|Lazarus Group|Taidoor
+T1031,Modify Existing Service,Persistence,APT41|APT32|Honeybee|APT19
+T1030,Data Transfer Size Limits,Exfiltration,Threat Group-3390
+T1029,Scheduled Transfer,Exfiltration,no
+T1028,Windows Remote Management,Execution|Lateral Movement,Threat Group-3390
+T1027,Obfuscated Files or Information,Defense Evasion,Machete|Soft Cell|Turla|TA505|Silence|APT33|Night Dragon|Darkhotel|Gallmaker|APT29|APT18|Tropic Trooper|menuPass|Patchwork|Cobalt Group|APT37|Threat Group-3390|Leafminer|Honeybee|Dark Caracal|APT19|FIN8|BlackOasis|Elderwood|Leviathan|MuddyWater|FIN7|Magic Hound|APT3|OilRig|APT32|Group5|Dust Storm|Lazarus Group|Putter Panda|APT28
+T1026,Multiband Communication,Command And Control,Lazarus Group
+T1025,Data from Removable Media,Collection,Machete|Turla|Gamaredon Group|APT28
+T1024,Custom Cryptographic Protocol,Command And Control,APT28|BRONZE BUTLER|Lazarus Group
+T1023,Shortcut Modification,Persistence,APT39|Darkhotel|APT29|Gorgon Group|FIN7|Dragonfly 2.0|Leviathan|Lazarus Group
+T1022,Data Encrypted,Exfiltration,Kimsuky|Soft Cell|Turla|menuPass|APT32|Patchwork|Honeybee|CopyKittens|BRONZE BUTLER|FIN6|Lazarus Group|Threat Group-3390|Ke3chang
+T1021,Remote Services,Lateral Movement,TEMP.Veles|Leviathan|APT39|OilRig|menuPass|GCMAN
+T1020,Automated Exfiltration,Exfiltration,Honeybee
+T1019,System Firmware,Persistence,no
+T1018,Remote System Discovery,Discovery,Soft Cell|APT32|Threat Group-3390|Dragonfly 2.0|Deep Panda|Ke3chang|Leafminer|FIN8|APT3|FIN5|BRONZE BUTLER|menuPass|FIN6|Turla
+T1017,Application Deployment Software,Lateral Movement,APT32
+T1016,System Network Configuration Discovery,Discovery,APT41|Soft Cell|APT39|APT32|Darkhotel|MuddyWater|APT1|APT19|Dragonfly 2.0|OilRig|Magic Hound|menuPass|Threat Group-3390|Stealth Falcon|Lazarus Group|APT3|Naikon|admin@338|Turla|Ke3chang
+T1015,Accessibility Features,Persistence|Privilege Escalation,APT41|APT3|APT29|Deep Panda|Axiom
+T1014,Rootkit,Defense Evasion,APT41|APT28|Winnti Group
+T1013,Port Monitors,Persistence|Privilege Escalation,no
+T1012,Query Registry,Discovery,APT32|Dragonfly 2.0|Threat Group-3390|OilRig|Stealth Falcon|Lazarus Group|Turla
+T1011,Exfiltration Over Other Network Medium,Exfiltration,no
+T1010,Application Window Discovery,Discovery,Lazarus Group
+T1009,Binary Padding,Defense Evasion,Patchwork|APT32|Leviathan|BRONZE BUTLER|Moafee
+T1008,Fallback Channels,Command And Control,APT41|OilRig|Lazarus Group
+T1007,System Service Discovery,Discovery,APT1|OilRig|Poseidon Group|admin@338|Turla|Ke3chang
+T1006,File System Logical Offsets,Defense Evasion,no
+T1005,Data from Local System,Collection,Kimsuky|Soft Cell|Turla|menuPass|Dark Caracal|Dragonfly 2.0|Honeybee|APT37|APT28|APT3|BRONZE BUTLER|Patchwork|Stealth Falcon|Lazarus Group|Dust Storm|Threat Group-3390|APT1|Ke3chang
+T1004,Winlogon Helper DLL,Persistence,Tropic Trooper|Turla
+T1003,Credential Dumping,Credential Access,APT41|Soft Cell|TEMP.Veles|APT33|Leviathan|APT39|Stolen Pencil|APT32|Night Dragon|Dragonfly 2.0|Leafminer|Lazarus Group|Magic Hound|APT37|MuddyWater|PLATINUM|FIN8|Sowbug|BRONZE BUTLER|FIN5|OilRig|menuPass|Strider|Patchwork|Stealth Falcon|Suckfly|FIN6|Poseidon Group|Threat Group-3390|APT3|Molerats|APT28|APT1|Ke3chang|Cleaver|Axiom
+T1002,Data Compressed,Exfiltration,APT41|Soft Cell|Gallmaker|APT33|APT32|APT39|MuddyWater|Honeybee|Magic Hound|APT28|Dragonfly 2.0|FIN8|BRONZE BUTLER|CopyKittens|Sowbug|APT3|menuPass|FIN6|Lazarus Group|Threat Group-3390|APT1|Ke3chang
+T1001,Data Obfuscation,Command And Control,APT28|Axiom

package/lookups/prohibited_apps_launching_cmd.csv

@@ -14,3 +14,4 @@ firefox.exe,prohibited
 java.exe,prohibited
 powershell.exe,prohibited
 mshta.exe, prohibited
+zoom.exe,prohibitied

requirements.txt

@@ -7,7 +7,7 @@ cfgv==3.1.0
 chardet==3.0.4
 configparser==5.0.0
 contextlib2==0.6.0.post1
-identify==1.4.16
+identify==1.4.19
 idna==2.9
 importlib-metadata==1.6.0
 importlib-resources==1.5.0
@@ -15,7 +15,7 @@ Jinja2==2.11.2
 jsonschema==3.2.0
 MarkupSafe==1.1.1
 more-itertools==8.3.0
-nodeenv==1.3.5
+nodeenv==1.4.0
 pathlib2==2.3.5
 pre-commit==2.4.0
 pyrsistent==0.16.0

response_tasks/get_authentication_logs_for_endpoint.yml

@@ -54,3 +54,4 @@ tags:
   - Windows Persistence Techniques
   - Windows Privilege Escalation
   - Windows Service Abuse
+  - Suspicious Zoom Child Processes

response_tasks/get_notable_info.yml

@@ -67,3 +67,5 @@ tags:
   - Windows Persistence Techniques
   - Windows Privilege Escalation
   - Windows Service Abuse
+  - Kubernetes Sensitive Role Activity
+  - Kubernetes Sensitive Object Access Activity

response_tasks/get_process_file_activity.yml

@@ -18,3 +18,4 @@ search: '| tstats `security_content_summariesonly` values(Filesystem.file_name)
 tags:
   analytics_story:
   - DHS Report TA18-074A
+  - Suspicious Zoom Child Processes

response_tasks/get_process_registry_activity.yml

@@ -18,3 +18,4 @@ search: '| tstats `security_content_summariesonly` values(Registry.registry_key_
 tags:
   analytics_story:
   - DHS Report TA18-074A
+  - Suspicious Zoom Child Processes

spec/lookups.spec.json

@@ -47,6 +47,13 @@
       ],
       "type": "string"
     },
+    "fields_list": {
+      "description": "A comma and space separated list of field names",
+      "examples": [
+        "_key, dest, process_name"
+      ],
+      "type": "string"
+    },
     "filename": {
       "description": "The name of the file to use for this lookup",
       "examples": [
@@ -54,6 +61,13 @@
       ],
       "type": "string"
     },
+    "filter": {
+      "description": "Use this attribute to improve search performance when working with significantly large KV",
+      "examples": [
+        "dest=\"SPLK_*\""
+      ],
+      "type": "string"
+    },
     "match_type": {
       "description": "A comma and space-delimited list of <match_type>(<field_name>) specification to allow for non-exact matching",
       "examples": [

stories/kubernetes_scanning_activity.yml

@@ -1,20 +1,15 @@
-name: Kubernetes Scanning Activity
+author: "Rod Soto, Splunk"
+date: "2020-04-15"
+description: "This story addresses detection against Kubernetes cluster fingerprint scan and attack by providing information on items such as source ip, user agent, cluster names."
 id: a9ef59cf-e981-4e66-9eef-bb049f695c09
-version: 1
-date: '2020-04-15'
-description: This story addresses detection against Kubernetes cluster fingerprint
-  scan and attack by providing information on items such as source ip, user agent,
-  cluster names.
-narrative: Kubernetes is the most used container orchestration platform, this orchestration
-  platform contains sensitve information and management priviledges of production
-  workloads, microservices and applications. These searches allow operator to detect
-  suspicious unauthenticated requests from the internet to kubernetes cluster.
-author: Rod Soto, Splunk
-type: ESCU
+name: "Kubernetes Scanning Activity"
+narrative: "Kubernetes is the most used container orchestration platform, this orchestration platform contains sensitve information and management priviledges of production workloads, microservices and applications. These searches allow operator to detect suspicious unauthenticated requests from the internet to kubernetes cluster."
 references:
-- https://github.com/splunk/cloud-datamodel-security-research
+  - "https://github.com/splunk/cloud-datamodel-security-research"
 tags:
-  analytics_story: Kubernetes Scanning Activity
-  usecase: Security Monitoring
+  analytics_story: "Kubernetes Scanning Activity"
   category:
-  - Cloud Security
+    - "Cloud Security"
+  usecase: "Security Monitoring"
+type: ESCU
+version: 1

stories/kubernetes_sensitive_object_access_activity.yml

@@ -0,0 +1,15 @@
+author: "Rod Soto, Splunk"
+date: "2020-05-20"
+description: "This story addresses detection and response of accounts acccesing Kubernetes cluster sensitive objects such as configmaps or secrets providing information on items such as user user, group. object, namespace and authorization reason."
+id: 2574e6d9-7254-4751-8925-0447deeec8ea
+name: "Kubernetes Sensitive Object Access Activity"
+narrative: "Kubernetes is the most used container orchestration platform, this orchestration platform contains sensitive objects within its architecture, specifically configmaps and secrets, if accessed by an attacker can lead to further compromise. These searches allow operator to detect suspicious requests against Kubernetes sensitive objects."
+references:
+  - https://www.splunk.com/en_us/blog/security/approaching-kubernetes-security-detecting-kubernetes-scan-with-splunk.html
+tags:
+  analytics_story: "Kubernetes Sensitive Object Access Activity"
+  category:
+    - "Cloud Security"
+  usecase: "Security Monitoring"
+type: ESCU
+version: 1

stories/kubernetes_sensitive_role_activity.yml

@@ -0,0 +1,15 @@
+author: "Rod Soto, Splunk"
+date: "2020-05-20"
+description: "This story addresses detection and response around Sensitive Role usage within a Kubernetes clusters against cluster resources and namespaces."
+id: 2574e6d9-7254-4751-8925-0447deeec8ew
+name: "Kubernetes Sensitive Role Activity"
+narrative: "Kubernetes is the most used container orchestration platform, this orchestration platform contains sensitive roles within its architecture, specifically configmaps and secrets, if accessed by an attacker can lead to further compromise. These searches allow operator to detect suspicious requests against Kubernetes role activities"
+references:
+  - https://www.splunk.com/en_us/blog/security/approaching-kubernetes-security-detecting-kubernetes-scan-with-splunk.html
+tags:
+  analytics_story: "Kubernetes Sensitive Role Activity"
+  category:
+    - "Cloud Security"
+  usecase: "Security Monitoring"
+type: ESCU
+version: 1

stories/suspicious_zoom_child_processes.yml

@@ -0,0 +1,24 @@
+name: Suspicious Zoom Child Processes
+id: aa3749a6-49c7-491e-a03f-4eaee5fe0258
+version: 1
+date: '2020-04-13'
+description: Attackers are using Zoom as an vector to increase privileges on a sytems. This story detects new
+    child processes of zoom and provides investigative actions for this detection.
+narrative: 'Zoom is a leader in modern enterprise video communications and its usage has
+    increased dramatically with a large amount of the population under stay-at-home orders
+    due to the COVID-19 pandemic. With increased usage has come increased scrutiny and 
+    several security flaws have been found with this application on both Windows and macOS
+    systems.\
+    
+    Current detections focus on finding new child processes of this application on a per host
+    basis. Investigative searches are included to gather information needed during an investigation.'
+author: David Dorsey, Splunk
+type: ESCU
+references:
+  - https://blog.rapid7.com/2020/04/02/dispelling-zoom-bugbears-what-you-need-to-know-about-the-latest-zoom-vulnerabilities/
+  - https://threatpost.com/two-zoom-zero-day-flaws-uncovered/154337/
+tags:
+  analytics_story: Suspicious Zoom Child Processes
+  usecase: Advanced Threat Detection
+  category:
+  - Adversary Tactics