Branch was auto-updated.

dist/escu/app.manifest

@@ -5,7 +5,7 @@
     "id": {
       "group": null, 
       "name": "DA-ESS-ContentUpdate", 
-      "version": "4.0.0"
+      "version": "4.0.1"
     }, 
     "author": [
       {

dist/escu/default/analyticstories.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-04-18T21:44:55 UTC
+# On Date: 2023-04-20T19:56:47 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/app.conf

@@ -4,7 +4,7 @@
 is_configured = false
 state = enabled
 state_change_requires_restart = false
-build = 13203
+build = 13253
 
 [triggers]
 reload.analytic_stories = simple
@@ -20,7 +20,7 @@ reload.es_investigations = simple
 
 [launcher]
 author = Splunk
-version = 4.0.0
+version = 4.0.1
 description = Explore the Analytic Stories included with ES Content Updates.
 
 [ui]

dist/escu/default/collections.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-04-18T21:44:55 UTC
+# On Date: 2023-04-20T19:56:47 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/content-version.conf

@@ -1,2 +1,2 @@
 [content-version]
-version = 4.0.0
+version = 4.0.1

dist/escu/default/es_investigations.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-04-18T21:44:55 UTC
+# On Date: 2023-04-20T19:56:47 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/macros.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-04-18T21:44:55 UTC
+# On Date: 2023-04-20T19:56:47 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/savedsearches.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-04-18T21:44:55 UTC
+# On Date: 2023-04-20T19:56:47 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/transforms.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-04-18T21:44:55 UTC
+# On Date: 2023-04-20T19:56:47 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/workflow_actions.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2023-04-18T21:44:55 UTC
+# On Date: 2023-04-20T19:56:47 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml

@@ -1,11 +1,11 @@
 name: System Process Running from Unexpected Location
 id: 28179107-099a-464a-94d3-08301e6c055f
-version: 4
-description: An attacker tries might try to use different version of a system command
-  without overriding original, or they might try to avoid some detection running the
-  process from a different folder. This detection checks that a list of system processes
-  run inside C:\\Windows\System32 or C:\\Windows\SysWOW64 The list of system processes
-  has been extracted from https://github.com/splunk/security_content/blob/develop/lookups/is_windows_system_file.csv
+version: 5
+description: An attacker might try to use a different version of a system command
+  without overriding the original, or they might try to avoid some detections by running
+  the process from a different folder. This detection checks that a list of system
+  processes are run inside C:\\Windows\System32 or C:\\Windows\SysWOW64. The list
+  of system processes has been extracted from https://github.com/splunk/security_content/blob/develop/lookups/is_windows_system_file.csv
   and the original detection https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml
 search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
   null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
@@ -55,24 +55,24 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   OR process_file_name="sort.exe" OR process_file_name="snmptrap.exe" OR process_file_name="smss.exe"
   OR process_file_name="slui.exe" OR process_file_name="sihost.exe" OR process_file_name="sigverif.exe"
   OR process_file_name="shutdown.exe" OR process_file_name="shrpubw.exe" OR process_file_name="shadow.exe"
-  OR process_file_name="sfc.exe" OR process_file_name="setx.exe" OR process_file_name="setupugc.exe"
-  OR process_file_name="setupcl.exe" OR process_file_name="setspn.exe" OR process_file_name="sethc.exe"
-  OR process_file_name="sessionmsg.exe" OR process_file_name="services.exe" OR process_file_name="secinit.exe"
-  OR process_file_name="sdiagnhost.exe" OR process_file_name="sdclt.exe" OR process_file_name="sdchange.exe"
-  OR process_file_name="sdbinst.exe" OR process_file_name="schtasks.exe" OR process_file_name="sc.exe"
-  OR process_file_name="sbunattend.exe" OR process_file_name="rwinsta.exe" OR process_file_name="runonce.exe"
-  OR process_file_name="rundll32.exe" OR process_file_name="runas.exe" OR process_file_name="rstrui.exe"
-  OR process_file_name="rrinstaller.exe" OR process_file_name="rmttpmvscmgrsvr.exe"
-  OR process_file_name="resmon.exe" OR process_file_name="reset.exe" OR process_file_name="replace.exe"
-  OR process_file_name="repair-bde.exe" OR process_file_name="relog.exe" OR process_file_name="rekeywiz.exe"
-  OR process_file_name="regsvr32.exe" OR process_file_name="regini.exe" OR process_file_name="regedt32.exe"
-  OR process_file_name="reg.exe" OR process_file_name="recover.exe" OR process_file_name="recdisc.exe"
-  OR process_file_name="rdrleakdiag.exe" OR process_file_name="rdpinput.exe" OR process_file_name="rdpclip.exe"
-  OR process_file_name="rasphone.exe" OR process_file_name="raserver.exe" OR process_file_name="rasdial.exe"
-  OR process_file_name="rasautou.exe" OR process_file_name="qwinsta.exe" OR process_file_name="quser.exe"
-  OR process_file_name="query.exe" OR process_file_name="qprocess.exe" OR process_file_name="qappsrv.exe"
-  OR process_file_name="pwlauncher.exe" OR process_file_name="psr.exe" OR process_file_name="provtool.exe"
-  OR process_file_name="proquota.exe" OR process_file_name="printui.exe" OR process_file_name="printfilterpipelinesvc.exe"
+  OR process_file_name="setx.exe" OR process_file_name="setupugc.exe" OR process_file_name="setupcl.exe"
+  OR process_file_name="setspn.exe" OR process_file_name="sethc.exe" OR process_file_name="sessionmsg.exe"
+  OR process_file_name="services.exe" OR process_file_name="secinit.exe" OR process_file_name="sdiagnhost.exe"
+  OR process_file_name="sdclt.exe" OR process_file_name="sdchange.exe" OR process_file_name="sdbinst.exe"
+  OR process_file_name="schtasks.exe" OR process_file_name="sc.exe" OR process_file_name="sbunattend.exe"
+  OR process_file_name="rwinsta.exe" OR process_file_name="runonce.exe" OR process_file_name="rundll32.exe"
+  OR process_file_name="runas.exe" OR process_file_name="rstrui.exe" OR process_file_name="rrinstaller.exe"
+  OR process_file_name="rmttpmvscmgrsvr.exe" OR process_file_name="resmon.exe" OR
+  process_file_name="reset.exe" OR process_file_name="replace.exe" OR process_file_name="repair-bde.exe"
+  OR process_file_name="relog.exe" OR process_file_name="rekeywiz.exe" OR process_file_name="regsvr32.exe"
+  OR process_file_name="regini.exe" OR process_file_name="regedt32.exe" OR process_file_name="reg.exe"
+  OR process_file_name="recover.exe" OR process_file_name="recdisc.exe" OR process_file_name="rdrleakdiag.exe"
+  OR process_file_name="rdpinput.exe" OR process_file_name="rdpclip.exe" OR process_file_name="rasphone.exe"
+  OR process_file_name="raserver.exe" OR process_file_name="rasdial.exe" OR process_file_name="rasautou.exe"
+  OR process_file_name="qwinsta.exe" OR process_file_name="quser.exe" OR process_file_name="query.exe"
+  OR process_file_name="qprocess.exe" OR process_file_name="qappsrv.exe" OR process_file_name="pwlauncher.exe"
+  OR process_file_name="psr.exe" OR process_file_name="provtool.exe" OR process_file_name="proquota.exe"
+  OR process_file_name="printui.exe" OR process_file_name="printfilterpipelinesvc.exe"
   OR process_file_name="print.exe" OR process_file_name="prevhost.exe" OR process_file_name="powercfg.exe"
   OR process_file_name="poqexec.exe" OR process_file_name="plasrv.exe" OR process_file_name="phoneactivate.exe"
   OR process_file_name="perfmon.exe" OR process_file_name="pcwrun.exe" OR process_file_name="pcawrk.exe"