diff --git a/bin/doc-gen.py b/bin/doc-gen.py index 8e1cdf0a12..2f19ab4a00 100644 --- a/bin/doc-gen.py +++ b/bin/doc-gen.py @@ -684,7 +684,8 @@ if __name__ == "__main__": gmd = args.gen_markdown_docs stories = load_objects("stories/*.yml") - detections = load_objects("detections/*.yml") + detections = [] + detections = load_objects("detections/*/*.yml") # complete_stories = generate_stories(REPO_PATH, verbose) # complete_detections = generate_detections(REPO_PATH, complete_stories) @@ -697,7 +698,7 @@ if __name__ == "__main__": if gmd: story_count, path = write_markdown_docs(stories, detections, OUTPUT_DIR) - print("{0} story documents have been successfully written to {1}".format(story_count, path)) + print("{0} story documents have been successfully written to {1}".format(story_count, path)) else: print("--gen_splunk_docs was set to false, not generating splunk documentation") diff --git a/bin/generate-actors-map.py b/bin/generate-actors-map.py index 936b7c0bbb..5c12dafe55 100644 --- a/bin/generate-actors-map.py +++ b/bin/generate-actors-map.py @@ -31,7 +31,8 @@ def main(argv): counted_techniques, max_count = count_techniques(techniques, all_techniques) print("load detections techniques") - detections = load_objects(path.join(cmdargs.projects_path),'detections/*.yml') + detections = [] + detections = load_objects(path.join(cmdargs.projects_path),'detections/*/*.yml') print("get matched techniques") matched_techniques = get_matched_techniques(counted_techniques, detections) diff --git a/bin/generate-coverage-map.py b/bin/generate-coverage-map.py index 1229816b4a..8866809359 100644 --- a/bin/generate-coverage-map.py +++ b/bin/generate-coverage-map.py @@ -28,7 +28,8 @@ def main(argv): techniques = get_all_techniques(cmdargs.projects_path) print("load detections") - detections = load_objects(path.join(cmdargs.projects_path),'detections/*.yml') + detections = [] + detections = load_objects(path.join(cmdargs.projects_path),'detections/*/*.yml') print("get matched techniques") matched_techniques = get_matched_techniques(techniques, detections) diff --git a/bin/generate.py b/bin/generate.py index d8d25d4de0..6866036659 100644 --- a/bin/generate.py +++ b/bin/generate.py @@ -569,11 +569,14 @@ if __name__ == "__main__": macros = load_objects("macros/*.yml", VERBOSE) lookups = load_objects("lookups/*.yml", VERBOSE) baselines = load_objects("baselines/*.yml", VERBOSE) - detections = load_objects("detections/*.yml", VERBOSE) responses = load_objects("responses/*.yml", VERBOSE) response_tasks = load_objects("response_tasks/*.yml", VERBOSE) deployments = load_objects("deployments/*.yml", VERBOSE) + # process all detections + detections = [] + detections = load_objects("detections/*/*.yml", VERBOSE) + try: if VERBOSE: print("generating Mitre lookups") @@ -585,6 +588,10 @@ if __name__ == "__main__": lookups_path = generate_collections_conf(lookups) detections = sorted(detections, key=lambda d: d['name']) + + # only use ESCU detections to the configurations + detections = [object for object in detections if object["type"].lower() == "escu"] + response_tasks = sorted(response_tasks, key=lambda i: i['name']) baselines = sorted(baselines, key=lambda b: b['name']) detection_path = generate_savedsearches_conf(detections, response_tasks, baselines, deployments) diff --git a/bin/validate.py b/bin/validate.py index 39fad27ce2..0246833c06 100644 --- a/bin/validate.py +++ b/bin/validate.py @@ -13,7 +13,7 @@ import argparse import datetime import string import re -from os import path +from os import path, walk def validate_schema(REPO_PATH, type, objects): @@ -28,9 +28,13 @@ def validate_schema(REPO_PATH, type, objects): except IOError: print("ERROR: reading schema file {0}".format(schema_file)) - manifest_files = path.join(path.expanduser(REPO_PATH), type + '/*.yml') + manifest_files = [] + for root, dirs, files in walk(REPO_PATH + "/" + type): + for file in files: + if file.endswith(".yml"): + manifest_files.append((path.join(root, file))) - for manifest_file in glob.glob(manifest_files): + for manifest_file in manifest_files: if verbose: print("processing manifest {0}".format(manifest_file)) @@ -42,7 +46,6 @@ def validate_schema(REPO_PATH, type, objects): print("Error reading {0}".format(manifest_file)) error = True continue - try: jsonschema.validate(instance=object, schema=schema) except jsonschema.exceptions.ValidationError as json_ve: diff --git a/detections/detect_new_login_attempts_to_routers.yml b/detections/application/detect_new_login_attempts_to_routers.yml similarity index 100% rename from detections/detect_new_login_attempts_to_routers.yml rename to detections/application/detect_new_login_attempts_to_routers.yml diff --git a/detections/detect_phishing_content___ssa.yml b/detections/application/detect_phishing_content___ssa.yml similarity index 100% rename from detections/detect_phishing_content___ssa.yml rename to detections/application/detect_phishing_content___ssa.yml diff --git a/detections/email_attachments_with_lots_of_spaces.yml b/detections/application/email_attachments_with_lots_of_spaces.yml similarity index 100% rename from detections/email_attachments_with_lots_of_spaces.yml rename to detections/application/email_attachments_with_lots_of_spaces.yml diff --git a/detections/email_files_written_outside_of_the_outlook_directory.yml b/detections/application/email_files_written_outside_of_the_outlook_directory.yml similarity index 100% rename from detections/email_files_written_outside_of_the_outlook_directory.yml rename to detections/application/email_files_written_outside_of_the_outlook_directory.yml diff --git a/detections/email_servers_sending_high_volume_traffic_to_hosts.yml b/detections/application/email_servers_sending_high_volume_traffic_to_hosts.yml similarity index 100% rename from detections/email_servers_sending_high_volume_traffic_to_hosts.yml rename to detections/application/email_servers_sending_high_volume_traffic_to_hosts.yml diff --git a/detections/identify_new_user_accounts.yml b/detections/application/identify_new_user_accounts.yml similarity index 100% rename from detections/identify_new_user_accounts.yml rename to detections/application/identify_new_user_accounts.yml diff --git a/detections/monitor_email_for_brand_abuse.yml b/detections/application/monitor_email_for_brand_abuse.yml similarity index 100% rename from detections/monitor_email_for_brand_abuse.yml rename to detections/application/monitor_email_for_brand_abuse.yml diff --git a/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml b/detections/application/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml similarity index 100% rename from detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml rename to detections/application/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml diff --git a/detections/no_windows_updates_in_a_time_frame.yml b/detections/application/no_windows_updates_in_a_time_frame.yml similarity index 100% rename from detections/no_windows_updates_in_a_time_frame.yml rename to detections/application/no_windows_updates_in_a_time_frame.yml diff --git a/detections/okta_account_lockout_events.yml b/detections/application/okta_account_lockout_events.yml similarity index 100% rename from detections/okta_account_lockout_events.yml rename to detections/application/okta_account_lockout_events.yml diff --git a/detections/okta_failed_sso_attempts.yml b/detections/application/okta_failed_sso_attempts.yml similarity index 100% rename from detections/okta_failed_sso_attempts.yml rename to detections/application/okta_failed_sso_attempts.yml diff --git a/detections/okta_user_logins_from_multiple_cities.yml b/detections/application/okta_user_logins_from_multiple_cities.yml similarity index 100% rename from detections/okta_user_logins_from_multiple_cities.yml rename to detections/application/okta_user_logins_from_multiple_cities.yml diff --git a/detections/open_redirect_in_splunk_web.yml b/detections/application/open_redirect_in_splunk_web.yml similarity index 100% rename from detections/open_redirect_in_splunk_web.yml rename to detections/application/open_redirect_in_splunk_web.yml diff --git a/detections/spectre_and_meltdown_vulnerable_systems.yml b/detections/application/spectre_and_meltdown_vulnerable_systems.yml similarity index 100% rename from detections/spectre_and_meltdown_vulnerable_systems.yml rename to detections/application/spectre_and_meltdown_vulnerable_systems.yml diff --git a/detections/splunk_enterprise_information_disclosure.yml b/detections/application/splunk_enterprise_information_disclosure.yml similarity index 100% rename from detections/splunk_enterprise_information_disclosure.yml rename to detections/application/splunk_enterprise_information_disclosure.yml diff --git a/detections/suspicious_email___uba_anomaly.yml b/detections/application/suspicious_email___uba_anomaly.yml similarity index 100% rename from detections/suspicious_email___uba_anomaly.yml rename to detections/application/suspicious_email___uba_anomaly.yml diff --git a/detections/suspicious_email_attachment_extensions.yml b/detections/application/suspicious_email_attachment_extensions.yml similarity index 100% rename from detections/suspicious_email_attachment_extensions.yml rename to detections/application/suspicious_email_attachment_extensions.yml diff --git a/detections/abnormally_high_aws_instances_launched_by_user.yml b/detections/cloud/abnormally_high_aws_instances_launched_by_user.yml similarity index 100% rename from detections/abnormally_high_aws_instances_launched_by_user.yml rename to detections/cloud/abnormally_high_aws_instances_launched_by_user.yml diff --git a/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml b/detections/cloud/abnormally_high_aws_instances_launched_by_user___mltk.yml similarity index 100% rename from detections/abnormally_high_aws_instances_launched_by_user___mltk.yml rename to detections/cloud/abnormally_high_aws_instances_launched_by_user___mltk.yml diff --git a/detections/abnormally_high_aws_instances_terminated_by_user.yml b/detections/cloud/abnormally_high_aws_instances_terminated_by_user.yml similarity index 100% rename from detections/abnormally_high_aws_instances_terminated_by_user.yml rename to detections/cloud/abnormally_high_aws_instances_terminated_by_user.yml diff --git a/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml b/detections/cloud/abnormally_high_aws_instances_terminated_by_user___mltk.yml similarity index 100% rename from detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml rename to detections/cloud/abnormally_high_aws_instances_terminated_by_user___mltk.yml diff --git a/detections/amazon_eks_kubernetes_cluster_scan_detection.yml b/detections/cloud/amazon_eks_kubernetes_cluster_scan_detection.yml similarity index 100% rename from detections/amazon_eks_kubernetes_cluster_scan_detection.yml rename to detections/cloud/amazon_eks_kubernetes_cluster_scan_detection.yml diff --git a/detections/amazon_eks_kubernetes_pod_scan_detection.yml b/detections/cloud/amazon_eks_kubernetes_pod_scan_detection.yml similarity index 100% rename from detections/amazon_eks_kubernetes_pod_scan_detection.yml rename to detections/cloud/amazon_eks_kubernetes_pod_scan_detection.yml diff --git a/detections/aws_cloud_provisioning_from_previously_unseen_city.yml b/detections/cloud/aws_cloud_provisioning_from_previously_unseen_city.yml similarity index 100% rename from detections/aws_cloud_provisioning_from_previously_unseen_city.yml rename to detections/cloud/aws_cloud_provisioning_from_previously_unseen_city.yml diff --git a/detections/aws_cloud_provisioning_from_previously_unseen_country.yml b/detections/cloud/aws_cloud_provisioning_from_previously_unseen_country.yml similarity index 100% rename from detections/aws_cloud_provisioning_from_previously_unseen_country.yml rename to detections/cloud/aws_cloud_provisioning_from_previously_unseen_country.yml diff --git a/detections/aws_cloud_provisioning_from_previously_unseen_ip_address.yml b/detections/cloud/aws_cloud_provisioning_from_previously_unseen_ip_address.yml similarity index 100% rename from detections/aws_cloud_provisioning_from_previously_unseen_ip_address.yml rename to detections/cloud/aws_cloud_provisioning_from_previously_unseen_ip_address.yml diff --git a/detections/aws_cloud_provisioning_from_previously_unseen_region.yml b/detections/cloud/aws_cloud_provisioning_from_previously_unseen_region.yml similarity index 100% rename from detections/aws_cloud_provisioning_from_previously_unseen_region.yml rename to detections/cloud/aws_cloud_provisioning_from_previously_unseen_region.yml diff --git a/detections/aws_cross_account_activity_from_previously_unseen_account.yml b/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml similarity index 100% rename from detections/aws_cross_account_activity_from_previously_unseen_account.yml rename to detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml diff --git a/detections/aws_detect_attach_to_role_policy.yml b/detections/cloud/aws_detect_attach_to_role_policy.yml similarity index 100% rename from detections/aws_detect_attach_to_role_policy.yml rename to detections/cloud/aws_detect_attach_to_role_policy.yml diff --git a/detections/aws_detect_permanent_key_creation.yml b/detections/cloud/aws_detect_permanent_key_creation.yml similarity index 100% rename from detections/aws_detect_permanent_key_creation.yml rename to detections/cloud/aws_detect_permanent_key_creation.yml diff --git a/detections/aws_detect_role_creation.yml b/detections/cloud/aws_detect_role_creation.yml similarity index 100% rename from detections/aws_detect_role_creation.yml rename to detections/cloud/aws_detect_role_creation.yml diff --git a/detections/aws_detect_sts_assume_role_abuse.yml b/detections/cloud/aws_detect_sts_assume_role_abuse.yml similarity index 100% rename from detections/aws_detect_sts_assume_role_abuse.yml rename to detections/cloud/aws_detect_sts_assume_role_abuse.yml diff --git a/detections/aws_detect_sts_get_session_token_abuse.yml b/detections/cloud/aws_detect_sts_get_session_token_abuse.yml similarity index 100% rename from detections/aws_detect_sts_get_session_token_abuse.yml rename to detections/cloud/aws_detect_sts_get_session_token_abuse.yml diff --git a/detections/aws_network_access_control_list_created_with_all_open_ports.yml b/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml similarity index 100% rename from detections/aws_network_access_control_list_created_with_all_open_ports.yml rename to detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml diff --git a/detections/aws_network_access_control_list_deleted.yml b/detections/cloud/aws_network_access_control_list_deleted.yml similarity index 100% rename from detections/aws_network_access_control_list_deleted.yml rename to detections/cloud/aws_network_access_control_list_deleted.yml diff --git a/detections/cloud_compute_instance_created_by_previously_unseen_user.yml b/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml similarity index 100% rename from detections/cloud_compute_instance_created_by_previously_unseen_user.yml rename to detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml diff --git a/detections/cloud_compute_instance_created_with_previously_unseen_image.yml b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml similarity index 100% rename from detections/cloud_compute_instance_created_with_previously_unseen_image.yml rename to detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml diff --git a/detections/cloud_compute_instance_created_with_previously_unseen_instance_type.yml b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml similarity index 100% rename from detections/cloud_compute_instance_created_with_previously_unseen_instance_type.yml rename to detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml diff --git a/detections/cloud_compute_instance_started_in_previously_unused_region.yml b/detections/cloud/cloud_compute_instance_started_in_previously_unused_region.yml similarity index 100% rename from detections/cloud_compute_instance_started_in_previously_unused_region.yml rename to detections/cloud/cloud_compute_instance_started_in_previously_unused_region.yml diff --git a/detections/detect_api_activity_from_users_without_mfa.yml b/detections/cloud/detect_api_activity_from_users_without_mfa.yml similarity index 100% rename from detections/detect_api_activity_from_users_without_mfa.yml rename to detections/cloud/detect_api_activity_from_users_without_mfa.yml diff --git a/detections/detect_aws_api_activities_from_unapproved_accounts.yml b/detections/cloud/detect_aws_api_activities_from_unapproved_accounts.yml similarity index 100% rename from detections/detect_aws_api_activities_from_unapproved_accounts.yml rename to detections/cloud/detect_aws_api_activities_from_unapproved_accounts.yml diff --git a/detections/detect_aws_console_login_by_user_from_new_city.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml similarity index 100% rename from detections/detect_aws_console_login_by_user_from_new_city.yml rename to detections/cloud/detect_aws_console_login_by_user_from_new_city.yml diff --git a/detections/detect_aws_console_login_by_user_from_new_country.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml similarity index 100% rename from detections/detect_aws_console_login_by_user_from_new_country.yml rename to detections/cloud/detect_aws_console_login_by_user_from_new_country.yml diff --git a/detections/detect_aws_console_login_by_user_from_new_region.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml similarity index 100% rename from detections/detect_aws_console_login_by_user_from_new_region.yml rename to detections/cloud/detect_aws_console_login_by_user_from_new_region.yml diff --git a/detections/detect_gcp_storage_access_from_a_new_ip.yml b/detections/cloud/detect_gcp_storage_access_from_a_new_ip.yml similarity index 100% rename from detections/detect_gcp_storage_access_from_a_new_ip.yml rename to detections/cloud/detect_gcp_storage_access_from_a_new_ip.yml diff --git a/detections/detect_new_api_calls_from_user_roles.yml b/detections/cloud/detect_new_api_calls_from_user_roles.yml similarity index 100% rename from detections/detect_new_api_calls_from_user_roles.yml rename to detections/cloud/detect_new_api_calls_from_user_roles.yml diff --git a/detections/detect_new_open_gcp_storage_buckets.yml b/detections/cloud/detect_new_open_gcp_storage_buckets.yml similarity index 100% rename from detections/detect_new_open_gcp_storage_buckets.yml rename to detections/cloud/detect_new_open_gcp_storage_buckets.yml diff --git a/detections/detect_new_open_s3_buckets.yml b/detections/cloud/detect_new_open_s3_buckets.yml similarity index 100% rename from detections/detect_new_open_s3_buckets.yml rename to detections/cloud/detect_new_open_s3_buckets.yml diff --git a/detections/detect_new_user_aws_console_login.yml b/detections/cloud/detect_new_user_aws_console_login.yml similarity index 100% rename from detections/detect_new_user_aws_console_login.yml rename to detections/cloud/detect_new_user_aws_console_login.yml diff --git a/detections/detect_new_user_aws_console_login___dm.yml b/detections/cloud/detect_new_user_aws_console_login___dm.yml similarity index 100% rename from detections/detect_new_user_aws_console_login___dm.yml rename to detections/cloud/detect_new_user_aws_console_login___dm.yml diff --git a/detections/detect_s3_access_from_a_new_ip.yml b/detections/cloud/detect_s3_access_from_a_new_ip.yml similarity index 100% rename from detections/detect_s3_access_from_a_new_ip.yml rename to detections/cloud/detect_s3_access_from_a_new_ip.yml diff --git a/detections/detect_spike_in_aws_api_activity.yml b/detections/cloud/detect_spike_in_aws_api_activity.yml similarity index 100% rename from detections/detect_spike_in_aws_api_activity.yml rename to detections/cloud/detect_spike_in_aws_api_activity.yml diff --git a/detections/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml b/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml similarity index 100% rename from detections/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml rename to detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml diff --git a/detections/detect_spike_in_blocked_outbound_traffic_from_your_aws.yml b/detections/cloud/detect_spike_in_blocked_outbound_traffic_from_your_aws.yml similarity index 100% rename from detections/detect_spike_in_blocked_outbound_traffic_from_your_aws.yml rename to detections/cloud/detect_spike_in_blocked_outbound_traffic_from_your_aws.yml diff --git a/detections/detect_spike_in_network_acl_activity.yml b/detections/cloud/detect_spike_in_network_acl_activity.yml similarity index 100% rename from detections/detect_spike_in_network_acl_activity.yml rename to detections/cloud/detect_spike_in_network_acl_activity.yml diff --git a/detections/detect_spike_in_s3_bucket_deletion.yml b/detections/cloud/detect_spike_in_s3_bucket_deletion.yml similarity index 100% rename from detections/detect_spike_in_s3_bucket_deletion.yml rename to detections/cloud/detect_spike_in_s3_bucket_deletion.yml diff --git a/detections/detect_spike_in_security_group_activity.yml b/detections/cloud/detect_spike_in_security_group_activity.yml similarity index 100% rename from detections/detect_spike_in_security_group_activity.yml rename to detections/cloud/detect_spike_in_security_group_activity.yml diff --git a/detections/detect_spike_in_security_hub_alerts_for_user.yml b/detections/cloud/detect_spike_in_security_hub_alerts_for_user.yml similarity index 100% rename from detections/detect_spike_in_security_hub_alerts_for_user.yml rename to detections/cloud/detect_spike_in_security_hub_alerts_for_user.yml diff --git a/detections/ec2_instance_modified_with_previously_unseen_user.yml b/detections/cloud/ec2_instance_modified_with_previously_unseen_user.yml similarity index 100% rename from detections/ec2_instance_modified_with_previously_unseen_user.yml rename to detections/cloud/ec2_instance_modified_with_previously_unseen_user.yml diff --git a/detections/ec2_instance_started_in_previously_unseen_region.yml b/detections/cloud/ec2_instance_started_in_previously_unseen_region.yml similarity index 100% rename from detections/ec2_instance_started_in_previously_unseen_region.yml rename to detections/cloud/ec2_instance_started_in_previously_unseen_region.yml diff --git a/detections/ec2_instance_started_with_previously_unseen_ami.yml b/detections/cloud/ec2_instance_started_with_previously_unseen_ami.yml similarity index 100% rename from detections/ec2_instance_started_with_previously_unseen_ami.yml rename to detections/cloud/ec2_instance_started_with_previously_unseen_ami.yml diff --git a/detections/ec2_instance_started_with_previously_unseen_instance_type.yml b/detections/cloud/ec2_instance_started_with_previously_unseen_instance_type.yml similarity index 100% rename from detections/ec2_instance_started_with_previously_unseen_instance_type.yml rename to detections/cloud/ec2_instance_started_with_previously_unseen_instance_type.yml diff --git a/detections/ec2_instance_started_with_previously_unseen_user.yml b/detections/cloud/ec2_instance_started_with_previously_unseen_user.yml similarity index 100% rename from detections/ec2_instance_started_with_previously_unseen_user.yml rename to detections/cloud/ec2_instance_started_with_previously_unseen_user.yml diff --git a/detections/gcp_detect_oauth_token_abuse.yml b/detections/cloud/gcp_detect_oauth_token_abuse.yml similarity index 100% rename from detections/gcp_detect_oauth_token_abuse.yml rename to detections/cloud/gcp_detect_oauth_token_abuse.yml diff --git a/detections/gcp_gcr_container_uploaded.yml b/detections/cloud/gcp_gcr_container_uploaded.yml similarity index 100% rename from detections/gcp_gcr_container_uploaded.yml rename to detections/cloud/gcp_gcr_container_uploaded.yml diff --git a/detections/gcp_kubernetes_cluster_pod_scan_detection.yml b/detections/cloud/gcp_kubernetes_cluster_pod_scan_detection.yml similarity index 100% rename from detections/gcp_kubernetes_cluster_pod_scan_detection.yml rename to detections/cloud/gcp_kubernetes_cluster_pod_scan_detection.yml diff --git a/detections/gcp_kubernetes_cluster_scan_detection.yml b/detections/cloud/gcp_kubernetes_cluster_scan_detection.yml similarity index 100% rename from detections/gcp_kubernetes_cluster_scan_detection.yml rename to detections/cloud/gcp_kubernetes_cluster_scan_detection.yml diff --git a/detections/kubernetes_aws_detect_most_active_service_accounts_by_pod.yml b/detections/cloud/kubernetes_aws_detect_most_active_service_accounts_by_pod.yml similarity index 100% rename from detections/kubernetes_aws_detect_most_active_service_accounts_by_pod.yml rename to detections/cloud/kubernetes_aws_detect_most_active_service_accounts_by_pod.yml diff --git a/detections/kubernetes_aws_detect_rbac_authorizations_by_account.yml b/detections/cloud/kubernetes_aws_detect_rbac_authorizations_by_account.yml similarity index 100% rename from detections/kubernetes_aws_detect_rbac_authorizations_by_account.yml rename to detections/cloud/kubernetes_aws_detect_rbac_authorizations_by_account.yml diff --git a/detections/kubernetes_aws_detect_sensitive_object_access.yml b/detections/cloud/kubernetes_aws_detect_sensitive_object_access.yml similarity index 100% rename from detections/kubernetes_aws_detect_sensitive_object_access.yml rename to detections/cloud/kubernetes_aws_detect_sensitive_object_access.yml diff --git a/detections/kubernetes_aws_detect_sensitive_role_access.yml b/detections/cloud/kubernetes_aws_detect_sensitive_role_access.yml similarity index 100% rename from detections/kubernetes_aws_detect_sensitive_role_access.yml rename to detections/cloud/kubernetes_aws_detect_sensitive_role_access.yml diff --git a/detections/kubernetes_aws_detect_service_accounts_forbidden_failure_access.yml b/detections/cloud/kubernetes_aws_detect_service_accounts_forbidden_failure_access.yml similarity index 100% rename from detections/kubernetes_aws_detect_service_accounts_forbidden_failure_access.yml rename to detections/cloud/kubernetes_aws_detect_service_accounts_forbidden_failure_access.yml diff --git a/detections/kubernetes_aws_detect_suspicious_kubectl_calls.yml b/detections/cloud/kubernetes_aws_detect_suspicious_kubectl_calls.yml similarity index 100% rename from detections/kubernetes_aws_detect_suspicious_kubectl_calls.yml rename to detections/cloud/kubernetes_aws_detect_suspicious_kubectl_calls.yml diff --git a/detections/kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace.yml b/detections/cloud/kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace.yml similarity index 100% rename from detections/kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace.yml rename to detections/cloud/kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace.yml diff --git a/detections/kubernetes_azure_detect_rbac_authorization_by_account.yml b/detections/cloud/kubernetes_azure_detect_rbac_authorization_by_account.yml similarity index 100% rename from detections/kubernetes_azure_detect_rbac_authorization_by_account.yml rename to detections/cloud/kubernetes_azure_detect_rbac_authorization_by_account.yml diff --git a/detections/kubernetes_azure_detect_sensitive_object_access.yml b/detections/cloud/kubernetes_azure_detect_sensitive_object_access.yml similarity index 100% rename from detections/kubernetes_azure_detect_sensitive_object_access.yml rename to detections/cloud/kubernetes_azure_detect_sensitive_object_access.yml diff --git a/detections/kubernetes_azure_detect_sensitive_role_access.yml b/detections/cloud/kubernetes_azure_detect_sensitive_role_access.yml similarity index 100% rename from detections/kubernetes_azure_detect_sensitive_role_access.yml rename to detections/cloud/kubernetes_azure_detect_sensitive_role_access.yml diff --git a/detections/kubernetes_azure_detect_service_accounts_forbidden_failure_access.yml b/detections/cloud/kubernetes_azure_detect_service_accounts_forbidden_failure_access.yml similarity index 100% rename from detections/kubernetes_azure_detect_service_accounts_forbidden_failure_access.yml rename to detections/cloud/kubernetes_azure_detect_service_accounts_forbidden_failure_access.yml diff --git a/detections/kubernetes_azure_detect_suspicious_kubectl_calls.yml b/detections/cloud/kubernetes_azure_detect_suspicious_kubectl_calls.yml similarity index 100% rename from detections/kubernetes_azure_detect_suspicious_kubectl_calls.yml rename to detections/cloud/kubernetes_azure_detect_suspicious_kubectl_calls.yml diff --git a/detections/kubernetes_azure_pod_scan_fingerprint.yml b/detections/cloud/kubernetes_azure_pod_scan_fingerprint.yml similarity index 100% rename from detections/kubernetes_azure_pod_scan_fingerprint.yml rename to detections/cloud/kubernetes_azure_pod_scan_fingerprint.yml diff --git a/detections/kubernetes_azure_scan_fingerprint.yml b/detections/cloud/kubernetes_azure_scan_fingerprint.yml similarity index 100% rename from detections/kubernetes_azure_scan_fingerprint.yml rename to detections/cloud/kubernetes_azure_scan_fingerprint.yml diff --git a/detections/kubernetes_gcp_detect_RBAC_authorizations_by_account.yml b/detections/cloud/kubernetes_gcp_detect_RBAC_authorizations_by_account.yml similarity index 100% rename from detections/kubernetes_gcp_detect_RBAC_authorizations_by_account.yml rename to detections/cloud/kubernetes_gcp_detect_RBAC_authorizations_by_account.yml diff --git a/detections/kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml b/detections/cloud/kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml similarity index 100% rename from detections/kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml rename to detections/cloud/kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml diff --git a/detections/kubernetes_gcp_detect_sensitive_object_access.yml b/detections/cloud/kubernetes_gcp_detect_sensitive_object_access.yml similarity index 100% rename from detections/kubernetes_gcp_detect_sensitive_object_access.yml rename to detections/cloud/kubernetes_gcp_detect_sensitive_object_access.yml diff --git a/detections/kubernetes_gcp_detect_sensitive_role_access.yml b/detections/cloud/kubernetes_gcp_detect_sensitive_role_access.yml similarity index 100% rename from detections/kubernetes_gcp_detect_sensitive_role_access.yml rename to detections/cloud/kubernetes_gcp_detect_sensitive_role_access.yml diff --git a/detections/kubernetes_gcp_detect_service_accounts_forbidden_failure_access.yml b/detections/cloud/kubernetes_gcp_detect_service_accounts_forbidden_failure_access.yml similarity index 100% rename from detections/kubernetes_gcp_detect_service_accounts_forbidden_failure_access.yml rename to detections/cloud/kubernetes_gcp_detect_service_accounts_forbidden_failure_access.yml diff --git a/detections/kubernetes_gcp_detect_suspicious_kubectl_calls.yml b/detections/cloud/kubernetes_gcp_detect_suspicious_kubectl_calls.yml similarity index 100% rename from detections/kubernetes_gcp_detect_suspicious_kubectl_calls.yml rename to detections/cloud/kubernetes_gcp_detect_suspicious_kubectl_calls.yml diff --git a/detections/new_container_uploaded_to_aws_ecr.yml b/detections/cloud/new_container_uploaded_to_aws_ecr.yml similarity index 100% rename from detections/new_container_uploaded_to_aws_ecr.yml rename to detections/cloud/new_container_uploaded_to_aws_ecr.yml diff --git a/detections/access_lsass_memory_for_dump_creation.yml b/detections/endpoint/access_lsass_memory_for_dump_creation.yml similarity index 100% rename from detections/access_lsass_memory_for_dump_creation.yml rename to detections/endpoint/access_lsass_memory_for_dump_creation.yml diff --git a/detections/attempt_to_add_certificate_to_untrusted_store.yml b/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml similarity index 100% rename from detections/attempt_to_add_certificate_to_untrusted_store.yml rename to detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml diff --git a/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml b/detections/endpoint/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml similarity index 100% rename from detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml rename to detections/endpoint/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml diff --git a/detections/attempt_to_stop_security_service.yml b/detections/endpoint/attempt_to_stop_security_service.yml similarity index 100% rename from detections/attempt_to_stop_security_service.yml rename to detections/endpoint/attempt_to_stop_security_service.yml diff --git a/detections/attempted_credential_dump_from_registry_via_reg_exe.yml b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml similarity index 100% rename from detections/attempted_credential_dump_from_registry_via_reg_exe.yml rename to detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml diff --git a/detections/attempted_credential_dump_from_registry_via_reg_exe___ssa.yml b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe___ssa.yml similarity index 100% rename from detections/attempted_credential_dump_from_registry_via_reg_exe___ssa.yml rename to detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe___ssa.yml diff --git a/detections/batch_file_write_to_system32.yml b/detections/endpoint/batch_file_write_to_system32.yml similarity index 100% rename from detections/batch_file_write_to_system32.yml rename to detections/endpoint/batch_file_write_to_system32.yml diff --git a/detections/child_processes_of_spoolsv_exe.yml b/detections/endpoint/child_processes_of_spoolsv_exe.yml similarity index 100% rename from detections/child_processes_of_spoolsv_exe.yml rename to detections/endpoint/child_processes_of_spoolsv_exe.yml diff --git a/detections/common_ransomware_extensions.yml b/detections/endpoint/common_ransomware_extensions.yml similarity index 100% rename from detections/common_ransomware_extensions.yml rename to detections/endpoint/common_ransomware_extensions.yml diff --git a/detections/common_ransomware_notes.yml b/detections/endpoint/common_ransomware_notes.yml similarity index 100% rename from detections/common_ransomware_notes.yml rename to detections/endpoint/common_ransomware_notes.yml diff --git a/detections/create_local_admin_accounts_using_net_exe.yml b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml similarity index 100% rename from detections/create_local_admin_accounts_using_net_exe.yml rename to detections/endpoint/create_local_admin_accounts_using_net_exe.yml diff --git a/detections/create_or_delete_windows_shares_using_net_exe.yml b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml similarity index 100% rename from detections/create_or_delete_windows_shares_using_net_exe.yml rename to detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml diff --git a/detections/create_remote_thread_into_lsass.yml b/detections/endpoint/create_remote_thread_into_lsass.yml similarity index 100% rename from detections/create_remote_thread_into_lsass.yml rename to detections/endpoint/create_remote_thread_into_lsass.yml diff --git a/detections/creation_of_shadow_copy.yml b/detections/endpoint/creation_of_shadow_copy.yml similarity index 100% rename from detections/creation_of_shadow_copy.yml rename to detections/endpoint/creation_of_shadow_copy.yml diff --git a/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml b/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml similarity index 100% rename from detections/creation_of_shadow_copy_with_wmic_and_powershell.yml rename to detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml diff --git a/detections/credential_dumping_via_copy_command_from_shadow_copy.yml b/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml similarity index 100% rename from detections/credential_dumping_via_copy_command_from_shadow_copy.yml rename to detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml diff --git a/detections/credential_dumping_via_symlink_to_shadow_copy.yml b/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml similarity index 100% rename from detections/credential_dumping_via_symlink_to_shadow_copy.yml rename to detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml diff --git a/detections/deleting_shadow_copies.yml b/detections/endpoint/deleting_shadow_copies.yml similarity index 100% rename from detections/deleting_shadow_copies.yml rename to detections/endpoint/deleting_shadow_copies.yml diff --git a/detections/detect_activity_related_to_pass_the_hash_attacks.yml b/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml similarity index 100% rename from detections/detect_activity_related_to_pass_the_hash_attacks.yml rename to detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml diff --git a/detections/detect_computer_changed_with_anonymous_account.yml b/detections/endpoint/detect_computer_changed_with_anonymous_account.yml similarity index 100% rename from detections/detect_computer_changed_with_anonymous_account.yml rename to detections/endpoint/detect_computer_changed_with_anonymous_account.yml diff --git a/detections/detect_credential_dumping_through_lsass_access.yml b/detections/endpoint/detect_credential_dumping_through_lsass_access.yml similarity index 100% rename from detections/detect_credential_dumping_through_lsass_access.yml rename to detections/endpoint/detect_credential_dumping_through_lsass_access.yml diff --git a/detections/detect_dump_lsass_memory_using_comsvcs___ssa.yml b/detections/endpoint/detect_dump_lsass_memory_using_comsvcs___ssa.yml similarity index 100% rename from detections/detect_dump_lsass_memory_using_comsvcs___ssa.yml rename to detections/endpoint/detect_dump_lsass_memory_using_comsvcs___ssa.yml diff --git a/detections/detect_excessive_account_lockouts_from_endpoint.yml b/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml similarity index 100% rename from detections/detect_excessive_account_lockouts_from_endpoint.yml rename to detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml diff --git a/detections/detect_excessive_user_account_lockouts.yml b/detections/endpoint/detect_excessive_user_account_lockouts.yml similarity index 100% rename from detections/detect_excessive_user_account_lockouts.yml rename to detections/endpoint/detect_excessive_user_account_lockouts.yml diff --git a/detections/detect_mimikatz_using_loaded_images.yml b/detections/endpoint/detect_mimikatz_using_loaded_images.yml similarity index 100% rename from detections/detect_mimikatz_using_loaded_images.yml rename to detections/endpoint/detect_mimikatz_using_loaded_images.yml diff --git a/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml b/detections/endpoint/detect_mimikatz_via_powershell_and_eventcode_4703.yml similarity index 100% rename from detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml rename to detections/endpoint/detect_mimikatz_via_powershell_and_eventcode_4703.yml diff --git a/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml b/detections/endpoint/detect_mshta_exe_running_scripts_in_command_line_arguments.yml similarity index 100% rename from detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml rename to detections/endpoint/detect_mshta_exe_running_scripts_in_command_line_arguments.yml diff --git a/detections/detect_new_local_admin_account.yml b/detections/endpoint/detect_new_local_admin_account.yml similarity index 100% rename from detections/detect_new_local_admin_account.yml rename to detections/endpoint/detect_new_local_admin_account.yml diff --git a/detections/detect_oulook_exe_writing_a__zip_file.yml b/detections/endpoint/detect_oulook_exe_writing_a__zip_file.yml similarity index 100% rename from detections/detect_oulook_exe_writing_a__zip_file.yml rename to detections/endpoint/detect_oulook_exe_writing_a__zip_file.yml diff --git a/detections/detect_path_interception_by_creation_of_program_exe.yml b/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml similarity index 100% rename from detections/detect_path_interception_by_creation_of_program_exe.yml rename to detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml diff --git a/detections/detect_processes_used_for_system_network_configuration_discovery.yml b/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml similarity index 100% rename from detections/detect_processes_used_for_system_network_configuration_discovery.yml rename to detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml diff --git a/detections/detect_prohibited_applications_spawning_cmd_exe.yml b/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml similarity index 100% rename from detections/detect_prohibited_applications_spawning_cmd_exe.yml rename to detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml diff --git a/detections/detect_psexec_with_accepteula_flag.yml b/detections/endpoint/detect_psexec_with_accepteula_flag.yml similarity index 100% rename from detections/detect_psexec_with_accepteula_flag.yml rename to detections/endpoint/detect_psexec_with_accepteula_flag.yml diff --git a/detections/detect_rare_executables.yml b/detections/endpoint/detect_rare_executables.yml similarity index 100% rename from detections/detect_rare_executables.yml rename to detections/endpoint/detect_rare_executables.yml diff --git a/detections/detect_usb_device_insertion.yml b/detections/endpoint/detect_usb_device_insertion.yml similarity index 100% rename from detections/detect_usb_device_insertion.yml rename to detections/endpoint/detect_usb_device_insertion.yml diff --git a/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml b/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml similarity index 100% rename from detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml rename to detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml diff --git a/detections/detect_windows_dns_sigred_via_splunk_stream.yml b/detections/endpoint/detect_windows_dns_sigred_via_splunk_stream.yml similarity index 100% rename from detections/detect_windows_dns_sigred_via_splunk_stream.yml rename to detections/endpoint/detect_windows_dns_sigred_via_splunk_stream.yml diff --git a/detections/detect_windows_dns_sigred_via_zeek.yml b/detections/endpoint/detect_windows_dns_sigred_via_zeek.yml similarity index 100% rename from detections/detect_windows_dns_sigred_via_zeek.yml rename to detections/endpoint/detect_windows_dns_sigred_via_zeek.yml diff --git a/detections/detection_of_tools_built_by_nirsoft.yml b/detections/endpoint/detection_of_tools_built_by_nirsoft.yml similarity index 100% rename from detections/detection_of_tools_built_by_nirsoft.yml rename to detections/endpoint/detection_of_tools_built_by_nirsoft.yml diff --git a/detections/disabling_remote_user_account_control.yml b/detections/endpoint/disabling_remote_user_account_control.yml similarity index 100% rename from detections/disabling_remote_user_account_control.yml rename to detections/endpoint/disabling_remote_user_account_control.yml diff --git a/detections/dump_lsass_via_comsvcs_dll.yml b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml similarity index 100% rename from detections/dump_lsass_via_comsvcs_dll.yml rename to detections/endpoint/dump_lsass_via_comsvcs_dll.yml diff --git a/detections/execution_of_file_with_multiple_extensions.yml b/detections/endpoint/execution_of_file_with_multiple_extensions.yml similarity index 100% rename from detections/execution_of_file_with_multiple_extensions.yml rename to detections/endpoint/execution_of_file_with_multiple_extensions.yml diff --git a/detections/execution_of_file_with_spaces_before_extension.yml b/detections/endpoint/execution_of_file_with_spaces_before_extension.yml similarity index 100% rename from detections/execution_of_file_with_spaces_before_extension.yml rename to detections/endpoint/execution_of_file_with_spaces_before_extension.yml diff --git a/detections/extended_period_without_successful_netbackup_backups.yml b/detections/endpoint/extended_period_without_successful_netbackup_backups.yml similarity index 100% rename from detections/extended_period_without_successful_netbackup_backups.yml rename to detections/endpoint/extended_period_without_successful_netbackup_backups.yml diff --git a/detections/file_with_samsam_extension.yml b/detections/endpoint/file_with_samsam_extension.yml similarity index 100% rename from detections/file_with_samsam_extension.yml rename to detections/endpoint/file_with_samsam_extension.yml diff --git a/detections/first_time_seen_child_process_of_zoom.yml b/detections/endpoint/first_time_seen_child_process_of_zoom.yml similarity index 100% rename from detections/first_time_seen_child_process_of_zoom.yml rename to detections/endpoint/first_time_seen_child_process_of_zoom.yml diff --git a/detections/first_time_seen_cmd_line___ssa.yml b/detections/endpoint/first_time_seen_cmd_line___ssa.yml similarity index 100% rename from detections/first_time_seen_cmd_line___ssa.yml rename to detections/endpoint/first_time_seen_cmd_line___ssa.yml diff --git a/detections/first_time_seen_command_line_argument.yml b/detections/endpoint/first_time_seen_command_line_argument.yml similarity index 100% rename from detections/first_time_seen_command_line_argument.yml rename to detections/endpoint/first_time_seen_command_line_argument.yml diff --git a/detections/first_time_seen_running_windows_service.yml b/detections/endpoint/first_time_seen_running_windows_service.yml similarity index 100% rename from detections/first_time_seen_running_windows_service.yml rename to detections/endpoint/first_time_seen_running_windows_service.yml diff --git a/detections/hiding_files_and_directories_with_attrib_exe.yml b/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml similarity index 100% rename from detections/hiding_files_and_directories_with_attrib_exe.yml rename to detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml diff --git a/detections/kerberoasting_spn_request_with_rc4_encryption.yml b/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml similarity index 100% rename from detections/kerberoasting_spn_request_with_rc4_encryption.yml rename to detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml diff --git a/detections/macos___re_opened_applications.yml b/detections/endpoint/macos___re_opened_applications.yml similarity index 100% rename from detections/macos___re_opened_applications.yml rename to detections/endpoint/macos___re_opened_applications.yml diff --git a/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml b/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml similarity index 100% rename from detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml rename to detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml diff --git a/detections/malicious_powershell_process___encoded_command.yml b/detections/endpoint/malicious_powershell_process___encoded_command.yml similarity index 100% rename from detections/malicious_powershell_process___encoded_command.yml rename to detections/endpoint/malicious_powershell_process___encoded_command.yml diff --git a/detections/malicious_powershell_process___execution_policy_bypass.yml b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml similarity index 100% rename from detections/malicious_powershell_process___execution_policy_bypass.yml rename to detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml diff --git a/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml b/detections/endpoint/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml similarity index 100% rename from detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml rename to detections/endpoint/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml diff --git a/detections/malicious_powershell_process_with_obfuscation_techniques.yml b/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml similarity index 100% rename from detections/malicious_powershell_process_with_obfuscation_techniques.yml rename to detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml diff --git a/detections/monitor_registry_keys_for_print_monitors.yml b/detections/endpoint/monitor_registry_keys_for_print_monitors.yml similarity index 100% rename from detections/monitor_registry_keys_for_print_monitors.yml rename to detections/endpoint/monitor_registry_keys_for_print_monitors.yml diff --git a/detections/osquery_pack___coldroot_detection.yml b/detections/endpoint/osquery_pack___coldroot_detection.yml similarity index 100% rename from detections/osquery_pack___coldroot_detection.yml rename to detections/endpoint/osquery_pack___coldroot_detection.yml diff --git a/detections/overwriting_accessibility_binaries.yml b/detections/endpoint/overwriting_accessibility_binaries.yml similarity index 100% rename from detections/overwriting_accessibility_binaries.yml rename to detections/endpoint/overwriting_accessibility_binaries.yml diff --git a/detections/process_execution_via_wmi.yml b/detections/endpoint/process_execution_via_wmi.yml similarity index 100% rename from detections/process_execution_via_wmi.yml rename to detections/endpoint/process_execution_via_wmi.yml diff --git a/detections/processes_created_by_netsh.yml b/detections/endpoint/processes_created_by_netsh.yml similarity index 100% rename from detections/processes_created_by_netsh.yml rename to detections/endpoint/processes_created_by_netsh.yml diff --git a/detections/processes_launching_netsh.yml b/detections/endpoint/processes_launching_netsh.yml similarity index 100% rename from detections/processes_launching_netsh.yml rename to detections/endpoint/processes_launching_netsh.yml diff --git a/detections/processes_tapping_keyboard_events.yml b/detections/endpoint/processes_tapping_keyboard_events.yml similarity index 100% rename from detections/processes_tapping_keyboard_events.yml rename to detections/endpoint/processes_tapping_keyboard_events.yml diff --git a/detections/prohibited_apps_spawning_cmdprompt___ssa.yml b/detections/endpoint/prohibited_apps_spawning_cmdprompt___ssa.yml similarity index 100% rename from detections/prohibited_apps_spawning_cmdprompt___ssa.yml rename to detections/endpoint/prohibited_apps_spawning_cmdprompt___ssa.yml diff --git a/detections/prohibited_software_on_endpoint.yml b/detections/endpoint/prohibited_software_on_endpoint.yml similarity index 100% rename from detections/prohibited_software_on_endpoint.yml rename to detections/endpoint/prohibited_software_on_endpoint.yml diff --git a/detections/rare_parent_process_relationship_lolbas___ssa.yaml b/detections/endpoint/rare_parent_process_relationship_lolbas___ssa.yaml similarity index 100% rename from detections/rare_parent_process_relationship_lolbas___ssa.yaml rename to detections/endpoint/rare_parent_process_relationship_lolbas___ssa.yaml diff --git a/detections/reg_exe_manipulating_windows_services_registry_keys.yml b/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml similarity index 100% rename from detections/reg_exe_manipulating_windows_services_registry_keys.yml rename to detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml diff --git a/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml b/detections/endpoint/reg_exe_used_to_hide_files_directories_via_registry_keys.yml similarity index 100% rename from detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml rename to detections/endpoint/reg_exe_used_to_hide_files_directories_via_registry_keys.yml diff --git a/detections/registry_keys_for_creating_shim_databases.yml b/detections/endpoint/registry_keys_for_creating_shim_databases.yml similarity index 100% rename from detections/registry_keys_for_creating_shim_databases.yml rename to detections/endpoint/registry_keys_for_creating_shim_databases.yml diff --git a/detections/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml similarity index 100% rename from detections/registry_keys_used_for_persistence.yml rename to detections/endpoint/registry_keys_used_for_persistence.yml diff --git a/detections/registry_keys_used_for_privilege_escalation.yml b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml similarity index 100% rename from detections/registry_keys_used_for_privilege_escalation.yml rename to detections/endpoint/registry_keys_used_for_privilege_escalation.yml diff --git a/detections/remote_desktop_process_running_on_system.yml b/detections/endpoint/remote_desktop_process_running_on_system.yml similarity index 100% rename from detections/remote_desktop_process_running_on_system.yml rename to detections/endpoint/remote_desktop_process_running_on_system.yml diff --git a/detections/remote_process_instantiation_via_wmi.yml b/detections/endpoint/remote_process_instantiation_via_wmi.yml similarity index 100% rename from detections/remote_process_instantiation_via_wmi.yml rename to detections/endpoint/remote_process_instantiation_via_wmi.yml diff --git a/detections/remote_registry_key_modifications.yml b/detections/endpoint/remote_registry_key_modifications.yml similarity index 100% rename from detections/remote_registry_key_modifications.yml rename to detections/endpoint/remote_registry_key_modifications.yml diff --git a/detections/remote_wmi_command_attempt.yml b/detections/endpoint/remote_wmi_command_attempt.yml similarity index 100% rename from detections/remote_wmi_command_attempt.yml rename to detections/endpoint/remote_wmi_command_attempt.yml diff --git a/detections/rundll_loading_dll_by_ordinal.yml b/detections/endpoint/rundll_loading_dll_by_ordinal.yml similarity index 100% rename from detections/rundll_loading_dll_by_ordinal.yml rename to detections/endpoint/rundll_loading_dll_by_ordinal.yml diff --git a/detections/samsam_test_file_write.yml b/detections/endpoint/samsam_test_file_write.yml similarity index 100% rename from detections/samsam_test_file_write.yml rename to detections/endpoint/samsam_test_file_write.yml diff --git a/detections/sc_exe_manipulating_windows_services.yml b/detections/endpoint/sc_exe_manipulating_windows_services.yml similarity index 100% rename from detections/sc_exe_manipulating_windows_services.yml rename to detections/endpoint/sc_exe_manipulating_windows_services.yml diff --git a/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml b/detections/endpoint/scheduled_task_name_used_by_dragonfly_threat_actors.yml similarity index 100% rename from detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml rename to detections/endpoint/scheduled_task_name_used_by_dragonfly_threat_actors.yml diff --git a/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml b/detections/endpoint/scheduled_tasks_used_in_badrabbit_ransomware.yml similarity index 100% rename from detections/scheduled_tasks_used_in_badrabbit_ransomware.yml rename to detections/endpoint/scheduled_tasks_used_in_badrabbit_ransomware.yml diff --git a/detections/schtasks_scheduling_job_on_remote_system.yml b/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml similarity index 100% rename from detections/schtasks_scheduling_job_on_remote_system.yml rename to detections/endpoint/schtasks_scheduling_job_on_remote_system.yml diff --git a/detections/schtasks_used_for_forcing_a_reboot.yml b/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml similarity index 100% rename from detections/schtasks_used_for_forcing_a_reboot.yml rename to detections/endpoint/schtasks_used_for_forcing_a_reboot.yml diff --git a/detections/script_execution_via_wmi.yml b/detections/endpoint/script_execution_via_wmi.yml similarity index 100% rename from detections/script_execution_via_wmi.yml rename to detections/endpoint/script_execution_via_wmi.yml diff --git a/detections/shim_database_file_creation.yml b/detections/endpoint/shim_database_file_creation.yml similarity index 100% rename from detections/shim_database_file_creation.yml rename to detections/endpoint/shim_database_file_creation.yml diff --git a/detections/shim_database_installation_with_suspicious_parameters.yml b/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml similarity index 100% rename from detections/shim_database_installation_with_suspicious_parameters.yml rename to detections/endpoint/shim_database_installation_with_suspicious_parameters.yml diff --git a/detections/short_lived_windows_accounts.yml b/detections/endpoint/short_lived_windows_accounts.yml similarity index 100% rename from detections/short_lived_windows_accounts.yml rename to detections/endpoint/short_lived_windows_accounts.yml diff --git a/detections/single_letter_process_on_endpoint.yml b/detections/endpoint/single_letter_process_on_endpoint.yml similarity index 100% rename from detections/single_letter_process_on_endpoint.yml rename to detections/endpoint/single_letter_process_on_endpoint.yml diff --git a/detections/spike_in_file_writes.yml b/detections/endpoint/spike_in_file_writes.yml similarity index 100% rename from detections/spike_in_file_writes.yml rename to detections/endpoint/spike_in_file_writes.yml diff --git a/detections/suspicious_changes_to_file_associations.yml b/detections/endpoint/suspicious_changes_to_file_associations.yml similarity index 100% rename from detections/suspicious_changes_to_file_associations.yml rename to detections/endpoint/suspicious_changes_to_file_associations.yml diff --git a/detections/suspicious_file_write.yml b/detections/endpoint/suspicious_file_write.yml similarity index 100% rename from detections/suspicious_file_write.yml rename to detections/endpoint/suspicious_file_write.yml diff --git a/detections/suspicious_java_classes.yml b/detections/endpoint/suspicious_java_classes.yml similarity index 100% rename from detections/suspicious_java_classes.yml rename to detections/endpoint/suspicious_java_classes.yml diff --git a/detections/suspicious_lnk_file_launching_a_process.yml b/detections/endpoint/suspicious_lnk_file_launching_a_process.yml similarity index 100% rename from detections/suspicious_lnk_file_launching_a_process.yml rename to detections/endpoint/suspicious_lnk_file_launching_a_process.yml diff --git a/detections/suspicious_reg_exe_process.yml b/detections/endpoint/suspicious_reg_exe_process.yml similarity index 100% rename from detections/suspicious_reg_exe_process.yml rename to detections/endpoint/suspicious_reg_exe_process.yml diff --git a/detections/suspicious_wevtutil_usage.yml b/detections/endpoint/suspicious_wevtutil_usage.yml similarity index 100% rename from detections/suspicious_wevtutil_usage.yml rename to detections/endpoint/suspicious_wevtutil_usage.yml diff --git a/detections/suspicious_writes_to_system_volume_information.yml b/detections/endpoint/suspicious_writes_to_system_volume_information.yml similarity index 100% rename from detections/suspicious_writes_to_system_volume_information.yml rename to detections/endpoint/suspicious_writes_to_system_volume_information.yml diff --git a/detections/suspicious_writes_to_windows_recycle_bin.yml b/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml similarity index 100% rename from detections/suspicious_writes_to_windows_recycle_bin.yml rename to detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml diff --git a/detections/system_process_running_unexpected_location___ssa.yml b/detections/endpoint/system_process_running_unexpected_location___ssa.yml similarity index 100% rename from detections/system_process_running_unexpected_location___ssa.yml rename to detections/endpoint/system_process_running_unexpected_location___ssa.yml diff --git a/detections/system_processes_run_from_unexpected_locations.yml b/detections/endpoint/system_processes_run_from_unexpected_locations.yml similarity index 100% rename from detections/system_processes_run_from_unexpected_locations.yml rename to detections/endpoint/system_processes_run_from_unexpected_locations.yml diff --git a/detections/uncommon_processes_on_endpoint.yml b/detections/endpoint/uncommon_processes_on_endpoint.yml similarity index 100% rename from detections/uncommon_processes_on_endpoint.yml rename to detections/endpoint/uncommon_processes_on_endpoint.yml diff --git a/detections/unload_sysmon_filter_driver.yml b/detections/endpoint/unload_sysmon_filter_driver.yml similarity index 100% rename from detections/unload_sysmon_filter_driver.yml rename to detections/endpoint/unload_sysmon_filter_driver.yml diff --git a/detections/unsigned_image_loaded_by_lsass.yml b/detections/endpoint/unsigned_image_loaded_by_lsass.yml similarity index 100% rename from detections/unsigned_image_loaded_by_lsass.yml rename to detections/endpoint/unsigned_image_loaded_by_lsass.yml diff --git a/detections/unsuccessful_netbackup_backups.yml b/detections/endpoint/unsuccessful_netbackup_backups.yml similarity index 100% rename from detections/unsuccessful_netbackup_backups.yml rename to detections/endpoint/unsuccessful_netbackup_backups.yml diff --git a/detections/unusual_lolbas_in_short_period_of_time___ssa.yml b/detections/endpoint/unusual_lolbas_in_short_period_of_time___ssa.yml similarity index 100% rename from detections/unusual_lolbas_in_short_period_of_time___ssa.yml rename to detections/endpoint/unusual_lolbas_in_short_period_of_time___ssa.yml diff --git a/detections/unusually_long_command_line.yml b/detections/endpoint/unusually_long_command_line.yml similarity index 100% rename from detections/unusually_long_command_line.yml rename to detections/endpoint/unusually_long_command_line.yml diff --git a/detections/unusually_long_command_line___mltk.yml b/detections/endpoint/unusually_long_command_line___mltk.yml similarity index 100% rename from detections/unusually_long_command_line___mltk.yml rename to detections/endpoint/unusually_long_command_line___mltk.yml diff --git a/detections/unusually_long_command_line___ssa.yml b/detections/endpoint/unusually_long_command_line___ssa.yml similarity index 100% rename from detections/unusually_long_command_line___ssa.yml rename to detections/endpoint/unusually_long_command_line___ssa.yml diff --git a/detections/unusually_long_content_type_length.yml b/detections/endpoint/unusually_long_content_type_length.yml similarity index 100% rename from detections/unusually_long_content_type_length.yml rename to detections/endpoint/unusually_long_content_type_length.yml diff --git a/detections/usn_journal_deletion.yml b/detections/endpoint/usn_journal_deletion.yml similarity index 100% rename from detections/usn_journal_deletion.yml rename to detections/endpoint/usn_journal_deletion.yml diff --git a/detections/web_servers_executing_suspicious_processes.yml b/detections/endpoint/web_servers_executing_suspicious_processes.yml similarity index 100% rename from detections/web_servers_executing_suspicious_processes.yml rename to detections/endpoint/web_servers_executing_suspicious_processes.yml diff --git a/detections/windows_event_log_cleared.yml b/detections/endpoint/windows_event_log_cleared.yml similarity index 100% rename from detections/windows_event_log_cleared.yml rename to detections/endpoint/windows_event_log_cleared.yml diff --git a/detections/windows_hosts_file_modification.yml b/detections/endpoint/windows_hosts_file_modification.yml similarity index 100% rename from detections/windows_hosts_file_modification.yml rename to detections/endpoint/windows_hosts_file_modification.yml diff --git a/detections/wmi_permanent_event_subscription.yml b/detections/endpoint/wmi_permanent_event_subscription.yml similarity index 100% rename from detections/wmi_permanent_event_subscription.yml rename to detections/endpoint/wmi_permanent_event_subscription.yml diff --git a/detections/wmi_permanent_event_subscription___sysmon.yml b/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml similarity index 100% rename from detections/wmi_permanent_event_subscription___sysmon.yml rename to detections/endpoint/wmi_permanent_event_subscription___sysmon.yml diff --git a/detections/wmi_temporary_event_subscription.yml b/detections/endpoint/wmi_temporary_event_subscription.yml similarity index 100% rename from detections/wmi_temporary_event_subscription.yml rename to detections/endpoint/wmi_temporary_event_subscription.yml diff --git a/detections/clients_connecting_to_multiple_dns_servers.yml b/detections/network/clients_connecting_to_multiple_dns_servers.yml similarity index 100% rename from detections/clients_connecting_to_multiple_dns_servers.yml rename to detections/network/clients_connecting_to_multiple_dns_servers.yml diff --git a/detections/detect_arp_poisoning.yml b/detections/network/detect_arp_poisoning.yml similarity index 100% rename from detections/detect_arp_poisoning.yml rename to detections/network/detect_arp_poisoning.yml diff --git a/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml b/detections/network/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml similarity index 100% rename from detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml rename to detections/network/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml diff --git a/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml b/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml similarity index 100% rename from detections/detect_hosts_connecting_to_dynamic_domain_providers.yml rename to detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml diff --git a/detections/detect_large_outbound_icmp_packets.yml b/detections/network/detect_large_outbound_icmp_packets.yml similarity index 100% rename from detections/detect_large_outbound_icmp_packets.yml rename to detections/network/detect_large_outbound_icmp_packets.yml diff --git a/detections/detect_long_dns_txt_record_response.yml b/detections/network/detect_long_dns_txt_record_response.yml similarity index 100% rename from detections/detect_long_dns_txt_record_response.yml rename to detections/network/detect_long_dns_txt_record_response.yml diff --git a/detections/detect_outbound_smb_traffic.yml b/detections/network/detect_outbound_smb_traffic.yml similarity index 100% rename from detections/detect_outbound_smb_traffic.yml rename to detections/network/detect_outbound_smb_traffic.yml diff --git a/detections/detect_rogue_dhcp_server.yml b/detections/network/detect_rogue_dhcp_server.yml similarity index 100% rename from detections/detect_rogue_dhcp_server.yml rename to detections/network/detect_rogue_dhcp_server.yml diff --git a/detections/detect_unauthorized_assets_by_mac_address.yml b/detections/network/detect_unauthorized_assets_by_mac_address.yml similarity index 100% rename from detections/detect_unauthorized_assets_by_mac_address.yml rename to detections/network/detect_unauthorized_assets_by_mac_address.yml diff --git a/detections/detect_zerologon_via_zeek.yml b/detections/network/detect_zerologon_via_zeek.yml similarity index 100% rename from detections/detect_zerologon_via_zeek.yml rename to detections/network/detect_zerologon_via_zeek.yml diff --git a/detections/detection_of_dns_tunnels.yml b/detections/network/detection_of_dns_tunnels.yml similarity index 100% rename from detections/detection_of_dns_tunnels.yml rename to detections/network/detection_of_dns_tunnels.yml diff --git a/detections/dns_query_length_outliers___mltk.yml b/detections/network/dns_query_length_outliers___mltk.yml similarity index 100% rename from detections/dns_query_length_outliers___mltk.yml rename to detections/network/dns_query_length_outliers___mltk.yml diff --git a/detections/dns_query_length_with_high_standard_deviation.yml b/detections/network/dns_query_length_with_high_standard_deviation.yml similarity index 100% rename from detections/dns_query_length_with_high_standard_deviation.yml rename to detections/network/dns_query_length_with_high_standard_deviation.yml diff --git a/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml b/detections/network/dns_query_requests_resolved_by_unauthorized_dns_servers.yml similarity index 100% rename from detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml rename to detections/network/dns_query_requests_resolved_by_unauthorized_dns_servers.yml diff --git a/detections/dns_record_changed.yml b/detections/network/dns_record_changed.yml similarity index 100% rename from detections/dns_record_changed.yml rename to detections/network/dns_record_changed.yml diff --git a/detections/excessive_dns_failures.yml b/detections/network/excessive_dns_failures.yml similarity index 100% rename from detections/excessive_dns_failures.yml rename to detections/network/excessive_dns_failures.yml diff --git a/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml b/detections/network/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml similarity index 100% rename from detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml rename to detections/network/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml diff --git a/detections/large_volume_of_dns_any_queries.yml b/detections/network/large_volume_of_dns_any_queries.yml similarity index 100% rename from detections/large_volume_of_dns_any_queries.yml rename to detections/network/large_volume_of_dns_any_queries.yml diff --git a/detections/monitor_dns_for_brand_abuse.yml b/detections/network/monitor_dns_for_brand_abuse.yml similarity index 100% rename from detections/monitor_dns_for_brand_abuse.yml rename to detections/network/monitor_dns_for_brand_abuse.yml diff --git a/detections/prohibited_network_traffic_allowed.yml b/detections/network/prohibited_network_traffic_allowed.yml similarity index 100% rename from detections/prohibited_network_traffic_allowed.yml rename to detections/network/prohibited_network_traffic_allowed.yml diff --git a/detections/protocol_or_port_mismatch.yml b/detections/network/protocol_or_port_mismatch.yml similarity index 100% rename from detections/protocol_or_port_mismatch.yml rename to detections/network/protocol_or_port_mismatch.yml diff --git a/detections/protocols_passing_authentication_in_cleartext.yml b/detections/network/protocols_passing_authentication_in_cleartext.yml similarity index 100% rename from detections/protocols_passing_authentication_in_cleartext.yml rename to detections/network/protocols_passing_authentication_in_cleartext.yml diff --git a/detections/remote_desktop_network_bruteforce.yml b/detections/network/remote_desktop_network_bruteforce.yml similarity index 100% rename from detections/remote_desktop_network_bruteforce.yml rename to detections/network/remote_desktop_network_bruteforce.yml diff --git a/detections/remote_desktop_network_traffic.yml b/detections/network/remote_desktop_network_traffic.yml similarity index 100% rename from detections/remote_desktop_network_traffic.yml rename to detections/network/remote_desktop_network_traffic.yml diff --git a/detections/smb_traffic_spike.yml b/detections/network/smb_traffic_spike.yml similarity index 100% rename from detections/smb_traffic_spike.yml rename to detections/network/smb_traffic_spike.yml diff --git a/detections/smb_traffic_spike___mltk.yml b/detections/network/smb_traffic_spike___mltk.yml similarity index 100% rename from detections/smb_traffic_spike___mltk.yml rename to detections/network/smb_traffic_spike___mltk.yml diff --git a/detections/tor_traffic.yml b/detections/network/tor_traffic.yml similarity index 100% rename from detections/tor_traffic.yml rename to detections/network/tor_traffic.yml diff --git a/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml b/detections/web/detect_attackers_scanning_for_vulnerable_jboss_servers.yml similarity index 100% rename from detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml rename to detections/web/detect_attackers_scanning_for_vulnerable_jboss_servers.yml diff --git a/detections/detect_f5_tmui_rct_cve_2020_5902.yml b/detections/web/detect_f5_tmui_rct_cve_2020_5902.yml similarity index 100% rename from detections/detect_f5_tmui_rct_cve_2020_5902.yml rename to detections/web/detect_f5_tmui_rct_cve_2020_5902.yml diff --git a/detections/detect_malicious_requests_to_exploit_jboss_servers.yml b/detections/web/detect_malicious_requests_to_exploit_jboss_servers.yml similarity index 100% rename from detections/detect_malicious_requests_to_exploit_jboss_servers.yml rename to detections/web/detect_malicious_requests_to_exploit_jboss_servers.yml diff --git a/detections/detect_web_traffic_to_dynamic_domain_providers.yml b/detections/web/detect_web_traffic_to_dynamic_domain_providers.yml similarity index 100% rename from detections/detect_web_traffic_to_dynamic_domain_providers.yml rename to detections/web/detect_web_traffic_to_dynamic_domain_providers.yml diff --git a/detections/monitor_web_traffic_for_brand_abuse.yml b/detections/web/monitor_web_traffic_for_brand_abuse.yml similarity index 100% rename from detections/monitor_web_traffic_for_brand_abuse.yml rename to detections/web/monitor_web_traffic_for_brand_abuse.yml diff --git a/detections/sql_injection_with_long_urls.yml b/detections/web/sql_injection_with_long_urls.yml similarity index 100% rename from detections/sql_injection_with_long_urls.yml rename to detections/web/sql_injection_with_long_urls.yml diff --git a/detections/web_fraud___account_harvesting.yml b/detections/web/web_fraud___account_harvesting.yml similarity index 100% rename from detections/web_fraud___account_harvesting.yml rename to detections/web/web_fraud___account_harvesting.yml diff --git a/detections/web_fraud___anomalous_user_clickspeed.yml b/detections/web/web_fraud___anomalous_user_clickspeed.yml similarity index 100% rename from detections/web_fraud___anomalous_user_clickspeed.yml rename to detections/web/web_fraud___anomalous_user_clickspeed.yml diff --git a/detections/web_fraud___password_sharing_across_accounts.yml b/detections/web/web_fraud___password_sharing_across_accounts.yml similarity index 100% rename from detections/web_fraud___password_sharing_across_accounts.yml rename to detections/web/web_fraud___password_sharing_across_accounts.yml