Branch was auto-updated.

bin/contentctl_project/contentctl_infrastructure/adapter/finding_report_writer.py

@@ -9,32 +9,6 @@ class FindingReportObject():
 
     @staticmethod
     def writeFindingReport(detection : Detection) -> None:
-    
-        # if detection.tags.confidence < 33:
-        #     detection.tags.confidence_id = 1
-        # elif detection.tags.confidence < 66:
-        #     detection.tags.confidence_id = 2
-        # else:
-        #     detection.tags.confidence_id = 3
-
-        # detection.tags.context_ids = list()
-        # for context in detection.tags.context:
-        #     detection.tags.context_ids.append(SES_CONTEXT_MAPPING[context])
-        
-        # if detection.tags.impact < 20:
-        #     detection.tags.impact_id = 1
-        # elif detection.tags.impact < 40:
-        #     detection.tags.impact_id = 2
-        # elif detection.tags.impact < 60:
-        #     detection.tags.impact_id = 3
-        # elif detection.tags.impact < 80:
-        #     detection.tags.impact_id = 4
-        # else:
-        #     detection.tags.impact_id = 5                 
-
-        # detection.tags.kill_chain_phases_id = dict()
-        # for kill_chain_phase in detection.tags.kill_chain_phases:
-        #     detection.tags.kill_chain_phases_id[kill_chain_phase] = SES_KILL_CHAIN_MAPPINGS[kill_chain_phase]
 
 
         if detection.tags.risk_score < 20:
@@ -53,15 +27,6 @@ class FindingReportObject():
             detection.tags.risk_level_id = 4
             detection.tags.risk_level = "Critical"  
 
-        # observable_str = "["
-        # for i in range(len(detection.tags.observable)):            
-        #     observable_str = observable_str + 'create_map("name", "' + detection.tags.observable[i]["name"] + '", "type_id", ' + str(SES_OBSERVABLE_TYPE_MAPPING[detection.tags.observable[i]["type"]]) + ', "value", ' + detection.tags.observable[i]["name"].replace(".", "_") + ')'
-        #     if not i == (len(detection.tags.observable) - 1):
-        #         observable_str = observable_str + ', '
-        # observable_str = observable_str + ']'
-
-        # detection.tags.observable_str = observable_str
-
         evidence_str = "create_map("
         for i in range(len(detection.tags.observable)):            
             evidence_str = evidence_str + '"' + detection.tags.observable[i]["name"] + '", ' + detection.tags.observable[i]["name"].replace(".", "_")
@@ -71,10 +36,15 @@ class FindingReportObject():
 
         detection.tags.evidence_str = evidence_str
 
+        if "actor.user.name" in detection.tags.required_fields:
+            actor_user_name = "actor_user_name"
+        else:
+            actor_user_name = "\"Unknown\""
+
         j2_env = Environment(
             loader=FileSystemLoader(os.path.join(os.path.dirname(__file__), 'templates')), 
             trim_blocks=True)
         template = j2_env.get_template('finding_report.j2')
-        body = template.render(detection=detection, attack_tactics_id_mapping=SES_ATTACK_TACTICS_ID_MAPPING)
+        body = template.render(detection=detection, attack_tactics_id_mapping=SES_ATTACK_TACTICS_ID_MAPPING, actor_user_name=actor_user_name)
 
         return body

bin/contentctl_project/contentctl_infrastructure/adapter/templates/finding_report.j2

@@ -7,10 +7,10 @@
     ],
     "time", timestamp,
     "evidence", {{ detection.tags.evidence_str }},
-    "message", concat("{{ detection.name }} has been triggered on ", device_hostname, " by ", process_user_name, "."),
+    "message", concat("{{ detection.name }} has been triggered on ", device_hostname, " by ", {{ actor_user_name }}, "."),
     "users", [
         create_map(
-            "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null)
+            "name", {{ actor_user_name }}, "uid", ucast(map_get(actor_user,"uid"), "string", null)
         )
     ],
     "activity_id", 1,

bin/contentctl_project/contentctl_infrastructure/builder/sigma_converter.py

@@ -28,7 +28,6 @@ class SigmaConverterInputDto:
     detection_folder : str
     input_path: str
     log_source: str
-    cim_to_ocsf: bool
 
 
 @dataclass(frozen=True)
@@ -159,9 +158,9 @@ class SigmaConverter():
 
                         cim_to_ocsf_mapping = self.get_cim_to_ocsf_mapping(data_source_new)
 
-                    elif input_dto.cim_to_ocsf:
-                        field_mapping = self.get_cim_to_ocsf_mapping(data_source)
-                        cim_to_ocsf_mapping = field_mapping
+                    # elif input_dto.cim_to_ocsf:
+                    #     field_mapping = self.get_cim_to_ocsf_mapping(data_source)
+                    #     cim_to_ocsf_mapping = field_mapping
 
                     else:
                         field_mapping = self.find_mapping(data_source.field_mappings, 'data_model', 'ocsf')
@@ -171,7 +170,7 @@ class SigmaConverter():
                     for field in field_mapping_underline["mapping"].keys():
                         field_mapping_underline["mapping"][field] = field_mapping_underline["mapping"][field].replace(".", "_")     
 
-                    self.add_required_fields(field_mapping, detection)
+                    self.add_required_fields(cim_to_ocsf_mapping, detection)
                     self.add_mappings(cim_to_ocsf_mapping, detection)
 
                     self.update_observables(detection)
@@ -189,7 +188,7 @@ class SigmaConverter():
                         )
                     )
 
-                    detection = self.convert_detection_fields(detection, field_mapping_underline)
+                    detection = self.convert_detection_fields(detection)
                     sigma_rule = self.get_sigma_rule(detection, data_source)
                     sigma_processing_pipeline = self.get_pipeline_from_processing_items(processing_items)
 
@@ -248,15 +247,27 @@ class SigmaConverter():
         }])
 
 
-    def convert_detection_fields(self, detection: Detection, mappings: dict) -> Detection:
+    # def convert_detection_fields(self, detection: Detection, mappings: dict) -> Detection:
+    #     for selection in detection.search.keys():
+    #         if selection != "condition":
+    #             new_selection = copy.deepcopy(detection.search[selection])
+    #             for field in detection.search[selection].keys():
+    #                 for mapping in mappings["mapping"].keys():
+    #                     if mapping == field:
+    #                         new_selection[mappings["mapping"][mapping]] =  detection.search[selection][field]
+    #                         new_selection.pop(field)
+    #             detection.search[selection] = new_selection
+
+    #     return detection
+
+    def convert_detection_fields(self, detection: Detection) -> Detection:
         for selection in detection.search.keys():
             if selection != "condition":
                 new_selection = copy.deepcopy(detection.search[selection])
                 for field in detection.search[selection].keys():
-                    for mapping in mappings["mapping"].keys():
-                        if mapping == field:
-                            new_selection[mappings["mapping"][mapping]] =  detection.search[selection][field]
-                            new_selection.pop(field)
+                    new_field_name = field.replace(".", "_")
+                    new_selection[new_field_name] = detection.search[selection][field]
+                    new_selection.pop(field)
                 detection.search[selection] = new_selection
 
         return detection
@@ -337,14 +348,9 @@ class SigmaConverter():
 
     def add_required_fields(self, field_mapping: dict, detection: Detection) -> None:
         required_fields = list()
-        required_fields = ["process.user.name", "device.hostname"]
+#        required_fields = ["process.user.name", "device.hostname"]
         for mapping in field_mapping["mapping"].keys():
-            for selection in detection.search.keys():
-                if selection != "condition":
-                    for detection_field in detection.search[selection]:
-                        if detection_field.startswith(mapping):
-                            if not field_mapping["mapping"][mapping] in required_fields:
-                                required_fields.append(field_mapping["mapping"][mapping])
+            required_fields.append(field_mapping["mapping"][mapping])
 
         detection.tags.required_fields = required_fields
 
@@ -361,14 +367,19 @@ class SigmaConverter():
     def update_observables(self, detection : Detection) -> None:
         mapping_field_to_type = {
             "process.user.name": "User Name",
+            "actor.user.name": "User Name",
             "device.hostname": "Hostname",
             "process.file.name": "File Name",
             "actor.process.file.name": "File Name",
             "actor.process.file.path": "File Name",
             "actor.process.cmd_line": "Process",
+            "actor.user.uid": "Other",
             "process.cmd_line": "Other",
             "process.file.path": "File",
-            "process.file.name": "File"
+            "process.file.name": "File",
+            "process.uid": "Other",
+            "process.pid": "Other",
+            "actor.process.pid": "Other"
         }
 
         observables = list()

contentctl.py

@@ -312,8 +312,6 @@ def convert(args) -> None:
         data_model = SigmaConverterTarget.RAW
     elif args.data_model == 'ocsf':
         data_model = SigmaConverterTarget.OCSF
-    elif args.data_model == 'all':
-        data_model = SigmaConverterTarget.ALL
     else:
         print("ERROR: data model " + args.data_model + " not supported")
         sys.exit(1)
@@ -323,8 +321,7 @@ def convert(args) -> None:
         detection_path = args.detection_path,
         detection_folder = args.detection_folder, 
         input_path = args.path,
-        log_source = args.log_source,
-        cim_to_ocsf = args.cim_to_ocsf
+        log_source = args.log_source
     )
 
     convert_input_dto = ConvertInputDto(
@@ -414,7 +411,6 @@ def main(args):
     convert_parser.add_argument("-lo", "--log_source", required=False, type=str, help="converter log source")
     convert_parser.add_argument("-dp", "--detection_path", required=False, type=str, help="path to a single detection")
     convert_parser.add_argument("-df", "--detection_folder", required=False, type=str, help="path to a detection folder")
-    convert_parser.add_argument("-cto", "--cim_to_ocsf", action=argparse.BooleanOptionalAction, help="temp: cim to ocsf")
     convert_parser.add_argument("-o", "--output", required=True, type=str, help="output path to store the detections")
     convert_parser.set_defaults(func=convert)
 

data_sources/endpoint/Powershell_4104.yml

@@ -21,4 +21,21 @@ raw_fields:
   - MessageNumber
   - MessageTotal
   - ScriptBlockId
-  - ScriptBlockText
+  - ScriptBlockText
+  - Path
+field_mappings:
+  - data_model: cim
+    data_set: Endpoint.Processes
+    mapping:
+      Computer: Processes.dest
+      Path: Processes.process_path
+      ScriptBlockId: Processes.process_id
+      ScriptBlockText: Processes.process
+      UserID: Processes.user_id
+  - data_model: ocsf
+    mapping:
+      Computer: device.hostname
+      Path: process.file.path
+      ScriptBlockId: process.uid
+      ScriptBlockText: process.cmd_line
+      UserID: actor.user.uid

data_sources/endpoint/Windows_Security_4688.yml

@@ -44,7 +44,7 @@ field_mappings:
       NewProcessName: process.file.path
       NewProcessName|endswith: process.file.name
       Process_Command_Line: process.cmd_line
-      SubjectUserSid: process.user.name
+      SubjectUserSid: actor.user.name
       ProcessId: actor.process.pid
       ParentProcessName: actor.process.file.path
       ParentProcessName|endswith: actor.process.file.name

detections/endpoint/windows_adfind_exe.yml

@@ -1,16 +1,14 @@
 name: Windows AdFind Exe
 id: bd3b0187-189b-46c0-be45-f52da2bae67f
-version: 2
-date: '2021-11-03'
+version: 3
+date: '2023-05-15'
 author: Jose Hernandez, Bhavin Patel, Splunk
 status: production
 type: TTP
 description: 'This search looks for the execution of `adfind.exe` with command-line
-  arguments that it uses by default. Specifically the filter or search functions.
+  arguments that it uses by default specifically the filter or search functions.
   It also considers the arguments necessary like objectcategory, see readme for more
-  details: https://www.joeware.net/freetools/tools/adfind/usage.htm. This has been
-  seen used before by Wizard Spider, FIN6 and actors whom also launched SUNBURST.
-  AdFind.exe is usually used a recon tool to enumare a domain controller.'
+  details: https://www.joeware.net/freetools/tools/adfind/usage.htm. AdFind.exe is a powerful tool that is commonly used for querying and retrieving information from Active Directory (AD). While it is primarily designed for AD administration and management, it has been seen used before by Wizard Spider, FIN6 and actors whom also launched SUNBURST.'
 data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
@@ -23,11 +21,11 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, and command-line executions from your endpoints. If
   you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
-known_false_positives: administrators rarely use adfind, usually not used for legitimate
-  reasons
+known_false_positives: ADfind is a command-line tool for AD administration and management that is seen to be leveraged by various adversaries. Filter out legitimate administrator usage using the filter macro.
 references:
 - https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/
 - https://www.mandiant.com/resources/a-nasty-trick-from-credential-theft-malware-to-business-disruption
+- https://www.joeware.net/freetools/tools/adfind/index.htm
 tags:
   analytic_story:
   - NOBELIUM Group

dev_ssa/endpoint/ssa___anomalous_usage_of_archive_tools.yml

@@ -11,13 +11,13 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process_name: WinRAR.exe
+    process.file.name: WinRAR.exe
   selection2:
-    process_name|startswith: 7z
+    process.file.name|startswith: 7z
   selection3:
-    process_name|startswith: winzip
+    process.file.name|startswith: winzip
   selection4:
-    parent_process_name|endswith:
+    actor.process.file.name|endswith:
     - powershell.exe
     - cmd.exe
   condition: (selection1 or selection2 or selection3) and selection4
@@ -42,33 +42,10 @@ tags:
   mitre_attack_id:
   - T1560.001
   - T1560
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - Processes.process_name
-  - Processes.process
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 42

dev_ssa/endpoint/ssa___attempt_to_delete_services.yml

@@ -14,8 +14,8 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process_name: sc.exe
-    process|contains: delete
+    process.file.name: sc.exe
+    process.cmd_line|contains: delete
   condition: selection1
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
@@ -39,34 +39,10 @@ tags:
   - T1489
   - T1543
   - T1543.003
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 36

dev_ssa/endpoint/ssa___attempt_to_disable_services.yml

@@ -14,11 +14,11 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process|contains: config
+    process.cmd_line|contains: config
   selection2:
-    process|contains: disabled
+    process.cmd_line|contains: disabled
   selection3:
-    process_name: sc.exe
+    process.file.name: sc.exe
   condition: selection1 and selection2 and selection3
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
@@ -41,33 +41,10 @@ tags:
     on endpoint $dest_device_id$ by user $dest_user_id$ attempting to disable a service.
   mitre_attack_id:
   - T1489
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 36

dev_ssa/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml

@@ -12,11 +12,11 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process_name:
+    process.file.name:
     - reg.exe
     - cmd.exe
   selection2:
-    process|re:
+    process.cmd_line|re:
     - HKEY_LOCAL_MACHINE\System
     - HKEY_LOCAL_MACHINE\SAM
     - HKEY_LOCAL_MACHINE\Security
@@ -24,7 +24,7 @@ search:
     - HKLM\SAM
     - HKLM\Security
   selection3:
-    process|re: save
+    process.cmd_line|re: save
   condition: selection1 and (selection2) and selection3
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
@@ -40,32 +40,15 @@ tags:
   asset_type: Endpoint
   confidence: 90
   impact: 70
-  message: An attempt to save registry keys storing credentials has been performed on 
+  message: An attempt to save registry keys storing credentials has been performed
+    on
   mitre_attack_id:
   - T1003
   - T1003.002
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Actor
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - process_name
-  - _time
-  - dest_device_id
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Actions on Objectives
   risk_score: 63

dev_ssa/endpoint/ssa___bcdedit_failure_recovery_modification.yml

@@ -12,11 +12,11 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process_name: bcdedit.exe
+    process.file.name: bcdedit.exe
   selection2:
-    process|contains: 'no'
+    process.cmd_line|contains: 'no'
   selection3:
-    process|contains: recoveryenabled
+    process.cmd_line|contains: recoveryenabled
   condition: selection1 and (selection2 and selection3)
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
@@ -37,34 +37,10 @@ tags:
     to recover the endpoint.
   mitre_attack_id:
   - T1490
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Actions on Objectives
   risk_score: 80

dev_ssa/endpoint/ssa___clear_unallocated_sector_using_cipher_app.yml

@@ -12,8 +12,8 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process_name: cipher.exe
-    process|contains: '/W:'
+    process.file.name: cipher.exe
+    process.cmd_line|contains: '/W:'
   condition: selection1
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
@@ -35,38 +35,10 @@ tags:
   mitre_attack_id:
   - T1070.004
   - T1070
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 90

dev_ssa/endpoint/ssa___delete_a_net_user.yml

@@ -15,11 +15,11 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process|contains: user
+    process.cmd_line|contains: user
   selection2:
-    process|contains: /delete
+    process.cmd_line|contains: /delete
   selection3:
-    process_name:
+    process.file.name:
     - net.exe
     - net1.exe
   condition: selection1 and selection2 and (selection3)
@@ -43,34 +43,10 @@ tags:
     account.
   mitre_attack_id:
   - T1531
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 49

dev_ssa/endpoint/ssa___deny_permission_using_cacls_utility.yml

@@ -13,11 +13,11 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process_name:
+    process.file.name:
     - icacls.exe
     - xcacls.exe
     - cacls.exe
-    process|re: deny
+    process.cmd_line|re: deny
   condition: (selection1)
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
@@ -34,30 +34,14 @@ tags:
   asset_type: Endpoint
   confidence: 70
   impact: 50
-  message: A cacls process $process_name$ with commandline $process$ try to deny
-    a permission of a file or directory in host $dest_device_id$
+  message: A cacls process $process_name$ with commandline $process$ try to deny a
+    permission of a file or directory in host $dest_device_id$
   mitre_attack_id:
   - T1222
-  observable:
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 35

dev_ssa/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.yml

@@ -11,27 +11,28 @@ description: The following analytic identifies parent processes, browsers, Windo
   need to be tuned to further enhance the risk.
 data_source:
 - Windows Security 4688
-search: 
+search:
   selection1:
-    parent_process_name:
-      - winword.exe
-      - excel.exe
-      - outlook.exe
-      - acrobat.exe
-      - acrord32.exe
-      - iexplore.exe
-      - opera.exe
-      - firefox.exe
-      - powershell.exe
+    actor.process.file.name:
+    - winword.exe
+    - excel.exe
+    - outlook.exe
+    - acrobat.exe
+    - acrord32.exe
+    - iexplore.exe
+    - opera.exe
+    - firefox.exe
+    - powershell.exe
   selection2:
-    parent_process_name: java.exe
+    actor.process.file.name: java.exe
   selection3:
-    parent_process_name|re: patch1-Hotfix1a
+    actor.process.file.name|re: patch1-Hotfix1a
   selection4:
-    parent_process_name: chrome.exe
+    actor.process.file.name: chrome.exe
   selection5:
-    process: chrome-extension
-  condition: selection1 or (selection2 and not selection3) or (selection4 and not selection5)
+    process.cmd_line: chrome-extension
+  condition: selection1 or (selection2 and not selection3) or (selection4 and not
+    selection5)
 how_to_implement: In order to successfully implement this analytic, you will need
   endpoint process data from a EDR product or Sysmon. This search has been modified
   to process raw sysmon data from attack_range's nxlogs on DSP.
@@ -51,32 +52,10 @@ tags:
     that warrants investigating.
   mitre_attack_id:
   - T1059
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Actor
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - process_name
-  - parent_process_name
-  - _time
-  - dest_device_id
-  - dest_user_id
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 35

dev_ssa/endpoint/ssa___detect_rclone_command_line_usage.yml

@@ -16,7 +16,7 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process|contains:
+    process.cmd_line|contains:
     - --multi-thread-streams
     - --transfers
     - --auto-confirm
@@ -28,7 +28,7 @@ search:
     - pcloud
     - mega
     - copy
-    process_name: rclone.exe
+    process.file.name: rclone.exe
   condition: (selection1)
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
@@ -53,34 +53,10 @@ tags:
     remote cloud service to move files or folders.
   mitre_attack_id:
   - T1020
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 35

dev_ssa/endpoint/ssa___disable_net_user_account.yml

@@ -13,11 +13,11 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process|contains: user
+    process.cmd_line|contains: user
   selection2:
-    process|contains: /active:no
+    process.cmd_line|contains: /active:no
   selection3:
-    process_name:
+    process.file.name:
     - net.exe
     - net1.exe
   condition: selection1 and selection2 and (selection3)
@@ -42,34 +42,10 @@ tags:
   mitre_attack_id:
   - T1489
   - T1078
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 49

dev_ssa/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml

@@ -15,13 +15,13 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process|contains:
+    process.cmd_line|contains:
     - -retry=
     - -type=
     - -q=
     - -qt=
     - -querytype=
-    process_name: nslookup.exe
+    process.file.name: nslookup.exe
   condition: (selection1)
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
@@ -46,34 +46,10 @@ tags:
     to DNS exfiltration.
   mitre_attack_id:
   - T1048
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 72

dev_ssa/endpoint/ssa___fsutil_zeroing_file.yml

@@ -12,8 +12,8 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process|contains: setzerodata
-    process_name: fsutil.exe
+    process.cmd_line|contains: setzerodata
+    process.file.name: fsutil.exe
   condition: (selection1)
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
@@ -37,34 +37,10 @@ tags:
     deletion.
   mitre_attack_id:
   - T1070
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 54

dev_ssa/endpoint/ssa___grant_permission_using_cacls_utility.yml

@@ -13,11 +13,11 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process_name:
+    process.file.name:
     - icacls.exe
     - xcacls.exe
     - cacls.exe
-    process|re: grant
+    process.cmd_line|re: grant
   condition: (selection1)
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
@@ -38,26 +38,10 @@ tags:
     user a permission to a file or directory in host $dest_device_id$
   mitre_attack_id:
   - T1222
-  observable:
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 35

dev_ssa/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml

@@ -13,8 +13,8 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process_name: attrib.exe
-    process|re: ''
+    process.file.name: attrib.exe
+    process.cmd_line|re: ''
   condition: selection1
 how_to_implement: You must be ingesting data that records process activity from your
   hosts to populate the Endpoint data model in the Processes node. You must also be
@@ -38,24 +38,10 @@ tags:
   mitre_attack_id:
   - T1222.001
   - T1222
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Endpoint
-    role:
-    - Victim
-  - name: parent_process
-    type: Other
-    role:
-    - Attacker
-    - Parent Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 72

dev_ssa/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml

@@ -15,12 +15,12 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process|re:
+    process.cmd_line|re:
     - 'S-1-1-0:'
     - 'SYSTEM:'
     - 'everyone:'
   selection2:
-    process_name:
+    process.file.name:
     - icacls.exe
     - xcacls.exe
     - cacls.exe
@@ -43,26 +43,10 @@ tags:
     a permission of a file or directory in host $dest_device_id$
   mitre_attack_id:
   - T1222
-  observable:
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 35

dev_ssa/endpoint/ssa___office_product_spawning_windows_script_host.yml

@@ -12,10 +12,10 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process_name:
+    process.file.name:
     - cscript.exe
     - wscript.exe
-    parent_process_name|re:
+    actor.process.file.name|re:
     - visio.exe
     - mspub.exe
     - powerpnt.exe
@@ -41,33 +41,10 @@ tags:
   mitre_attack_id:
   - T1566
   - T1566.001
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 63

dev_ssa/endpoint/ssa___resize_shadowstorage_volume.yml

@@ -13,13 +13,13 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process|contains: shadowstorage
+    process.cmd_line|contains: shadowstorage
   selection2:
-    process|contains: resize
+    process.cmd_line|contains: resize
   selection3:
-    process|contains: maxsize
+    process.cmd_line|contains: maxsize
   selection4:
-    process_name: vssadmin.exe
+    process.file.name: vssadmin.exe
   condition: selection1 and selection2 and selection3 and selection4
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
@@ -42,34 +42,10 @@ tags:
     copy to perform offline password cracking.
   mitre_attack_id:
   - T1489
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 64

dev_ssa/endpoint/ssa___sdelete_application_execution.yml

@@ -14,7 +14,7 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process|contains:
+    process.cmd_line|contains:
     - .xls
     - .gz
     - .tar
@@ -42,7 +42,7 @@ search:
     - '-p '
     - '-f '
     - '-c '
-    process_name|contains: sdelete
+    process.file.name|contains: sdelete
   condition: (selection1)
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
@@ -66,36 +66,10 @@ tags:
   - T1485
   - T1070.004
   - T1070
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest
-  - user
-  - parent_process_name
-  - parent_process
-  - process_name
-  - process
-  - process_id
-  - process_path
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 42

dev_ssa/endpoint/ssa___system_process_running_from_unexpected_location.yml

@@ -15,7 +15,7 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process_name:
+    process.file.name:
     - xwizard.exe
     - xpsrchvw.exe
     - xcopy.exe
@@ -577,9 +577,9 @@ search:
     - adaptertroubleshooter.exe
     - arp.exe
   selection2:
-    process_path|re: \\windows\\syswow64
+    process.file.path|re: \\windows\\syswow64
   selection3:
-    process_path|re: \\windows\\system32
+    process.file.path|re: \\windows\\system32
   condition: selection1 and not selection2 and not selection3
 how_to_implement: Collect endpoint data such as sysmon or 4688 events.
 known_false_positives: None
@@ -595,23 +595,10 @@ tags:
     folder path in host $dest_device_id$
   mitre_attack_id:
   - T1036
-  observable:
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - dest_device_id
-  - process_name
-  - _time
-  - dest_user_id
-  - process_path
+  required_fields: []
   kill_chain_phases:
   - Actions on Objectives
   risk_score: 56

dev_ssa/endpoint/ssa___wbadmin_delete_system_backups.yml

@@ -12,9 +12,9 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process_name: wbadmin.exe
+    process.file.name: wbadmin.exe
   selection2:
-    process|contains:
+    process.cmd_line|contains:
     - systemstatebackup
     - catalog
     - delete
@@ -40,34 +40,10 @@ tags:
     backups.
   mitre_attack_id:
   - T1490
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 15

dev_ssa/endpoint/ssa___wevtutil_usage_to_clear_logs.yml

@@ -12,15 +12,15 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process|re:
+    process.cmd_line|re:
     - powershell
     - setup
     - application
     - sysmon
     - system
     - security
-    process|contains: ' cl '
-    process_name: wevtutil.exe
+    process.cmd_line|contains: ' cl '
+    process.file.name: wevtutil.exe
   condition: (selection1)
 how_to_implement: You must be ingesting data that records process activity from your
   hosts to populate the Endpoint data model in the Processes node. You must also be
@@ -41,30 +41,15 @@ tags:
   asset_type: Endpoint
   confidence: 90
   impact: 70
-  message: A wevtutil process $process_name$ with commandline $process$ to clear
-    event logs in host $dest_device_id$
+  message: A wevtutil process $process_name$ with commandline $process$ to clear event
+    logs in host $dest_device_id$
   mitre_attack_id:
   - T1070
   - T1070.001
-  observable:
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 63

dev_ssa/endpoint/ssa___wevtutil_usage_to_disable_logs.yml

@@ -12,11 +12,11 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process|contains: /e:false
+    process.cmd_line|contains: /e:false
   selection2:
-    process|contains: ' sl '
+    process.cmd_line|contains: ' sl '
   selection3:
-    process_name: wevtutil.exe
+    process.file.name: wevtutil.exe
   condition: selection1 and selection2 and selection3
 how_to_implement: You must be ingesting data that records process activity from your
   hosts to populate the Endpoint data model in the Processes node. You must also be
@@ -41,25 +41,10 @@ tags:
   mitre_attack_id:
   - T1070
   - T1070.001
-  observable:
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 63

dev_ssa/endpoint/ssa___windows_bits_job_persistence.yml

@@ -16,7 +16,7 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process|contains:
+    process.cmd_line|contains:
     - resume
     - setcustomheaders
     - setminretrydelay
@@ -24,7 +24,7 @@ search:
     - setnotifyflags
     - addfile
     - create
-    process_name: bitsadmin.exe
+    process.file.name: bitsadmin.exe
   condition: (selection1)
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
@@ -50,34 +50,10 @@ tags:
     on endpoint $dest$ by user $dest_user_id$ attempting to persist using BITS.
   mitre_attack_id:
   - T1197
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 56

dev_ssa/endpoint/ssa___windows_bitsadmin_download_file.yml

@@ -21,8 +21,8 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process|contains: transfer
-    process_name: bitsadmin.exe
+    process.cmd_line|contains: transfer
+    process.file.name: bitsadmin.exe
   condition: (selection1)
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
@@ -50,34 +50,10 @@ tags:
   mitre_attack_id:
   - T1197
   - T1105
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 49

dev_ssa/endpoint/ssa___windows_certutil_decode_file.yml

@@ -17,8 +17,8 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process|contains: decode
-    process_name: certutil.exe
+    process.cmd_line|contains: decode
+    process.file.name: certutil.exe
   condition: (selection1)
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
@@ -45,34 +45,10 @@ tags:
     on disk.
   mitre_attack_id:
   - T1140
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 40

dev_ssa/endpoint/ssa___windows_certutil_urlcache_download.yml

@@ -16,13 +16,13 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process_name: certutil.exe
+    process.file.name: certutil.exe
   selection2:
-    process|contains: split
+    process.cmd_line|contains: split
   selection3:
-    process|contains: urlcache
+    process.cmd_line|contains: urlcache
   selection4:
-    process|contains: urlcache
+    process.cmd_line|contains: urlcache
   condition: selection1 and selection2 and selection3 or selection4
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
@@ -45,34 +45,10 @@ tags:
     on endpoint $dest_device_id$ by user $dest_user_id$ attempting to download a file.
   mitre_attack_id:
   - T1105
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 90

dev_ssa/endpoint/ssa___windows_certutil_verifyctl_download.yml

@@ -16,13 +16,13 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process_name: certutil.exe
+    process.file.name: certutil.exe
   selection2:
-    process|contains: split
+    process.cmd_line|contains: split
   selection3:
-    process|contains: verifyctl
+    process.cmd_line|contains: verifyctl
   selection4:
-    process|contains: verifyctl
+    process.cmd_line|contains: verifyctl
   condition: selection1 and selection2 and selection3 or selection4
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
@@ -46,34 +46,10 @@ tags:
     on endpoint $dest_device_id$ by user $dest_user_id$ attempting to download a file.
   mitre_attack_id:
   - T1105
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 90

dev_ssa/endpoint/ssa___windows_com_hijacking_inprocserver32_modification.yml

@@ -17,8 +17,8 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process|re: inprocserver32
-    process_name: reg.exe
+    process.cmd_line|re: inprocserver32
+    process.file.name: reg.exe
   condition: selection1
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
@@ -40,34 +40,10 @@ tags:
   mitre_attack_id:
   - T1546.015
   - T1546
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 64

dev_ssa/endpoint/ssa___windows_curl_upload_to_remote_destination.yml

@@ -27,13 +27,13 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process|contains:
+    process.cmd_line|contains:
     - '-F '
     - '--data '
     - '-d '
     - '--upload-file '
     - '-T '
-    process_name|re: curl.exe
+    process.file.name|re: curl.exe
   condition: selection1
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
@@ -56,34 +56,10 @@ tags:
     destination.
   mitre_attack_id:
   - T1105
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 80

dev_ssa/endpoint/ssa___windows_defender_tools_in_non_standard_path.yml

@@ -11,11 +11,11 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process_name|re: mpcmdrun.exe
+    process.file.name|re: mpcmdrun.exe
   selection2:
-    process_path|re: \\windows defender
+    process.file.path|re: \\windows defender
   selection3:
-    process_path|re: \\microsoft\\windows defender\\platform
+    process.file.path|re: \\microsoft\\windows defender\\platform
   condition: selection1 and not selection2 and not selection3
 how_to_implement: Collect endpoint data such as sysmon or 4688 events.
 known_false_positives: False positives may be present and filtering may be required.
@@ -33,24 +33,10 @@ tags:
   mitre_attack_id:
   - T1036
   - T1036.003
-  observable:
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - dest_device_id
-  - process_name
-  - _time
-  - dest_user_id
-  - process_path
-  - process
+  required_fields: []
   kill_chain_phases:
   - Actions on Objectives
   risk_score: 56

dev_ssa/endpoint/ssa___windows_diskshadow_proxy_execution.yml

@@ -15,10 +15,10 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process|contains:
+    process.cmd_line|contains:
     - /s
     - -S
-    process_name: diskshadow.exe
+    process.file.name: diskshadow.exe
   condition: selection1
 how_to_implement: To successfully implement this search you need to be ingesting information
   on processes that include the name of the process responsible for the changes from
@@ -37,34 +37,10 @@ tags:
     on endpoint $dest_device_id$ by user $dest_user_id$ attempting to run a script.
   mitre_attack_id:
   - T1218
-  observable:
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 49

dev_ssa/endpoint/ssa___windows_dotnet_binary_in_non_standard_path.yml

@@ -15,7 +15,7 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process_name|re:
+    process.file.name|re:
     - MSBuild.exe
     - comsvcconfig.exe
     - dfsradmin.exe
@@ -60,7 +60,7 @@ search:
     - filehistory.exe
     - secureassessmentbrowser.exe
   selection2:
-    process_path|re:
+    process.file.path|re:
     - \\windows\\system32
     - \\windows\\syswow64
     - \\windows\\adws
@@ -95,24 +95,10 @@ tags:
   - T1036.003
   - T1218
   - T1218.004
-  observable:
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - dest_device_id
-  - process_name
-  - _time
-  - dest_user_id
-  - process_path
-  - process
+  required_fields: []
   kill_chain_phases:
   - Actions on Objectives
   risk_score: 49

dev_ssa/endpoint/ssa___windows_exchange_powershell_module_usage.yml

@@ -28,10 +28,10 @@ description: 'The following analytic identifies the usage of Exchange PowerShell
   This cmdlet returns all mail-enabled objects (for example, mailboxes, mail users,
   mail contacts, and distribution groups).'
 data_source:
-- Windows Security 4688
+- Powershell 4104
 search:
   selection1:
-    process|re:
+    process.cmd_line|re:
     - get-recipient
     - new-mailboxsearch
     - new-managementroleassignment
@@ -63,22 +63,10 @@ tags:
   mitre_attack_id:
   - T1059
   - T1059.001
-  observable:
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Actions on Objectives
   risk_score: 32

dev_ssa/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml

@@ -14,20 +14,20 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process|contains:
+    process.cmd_line|contains:
     - ms-msdt:/id
     - ms-msdt:-id
     - ms-msdt:/id
     - 'ms-msdt:'
     - msdt
-    process_name: msdt.exe
+    process.file.name: msdt.exe
   selection2:
-    process|re:
+    process.cmd_line|re:
     - .xml
     - it_rebrowseforfile=
     - it_browseforfile=
   selection3:
-    process|re: pcwdiagnostic
+    process.cmd_line|re: pcwdiagnostic
   condition: selection1 and selection2 and selection3
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
@@ -54,30 +54,10 @@ tags:
     of indirect command execution.
   mitre_attack_id:
   - T1218
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 100

dev_ssa/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml

@@ -17,10 +17,10 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process|contains:
+    process.cmd_line|contains:
     - https://
     - http://
-    process_name: explorer.exe
+    process.file.name: explorer.exe
   condition: (selection1)
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
@@ -40,34 +40,10 @@ tags:
     destination to download an additional payload.
   mitre_attack_id:
   - T1105
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 25

dev_ssa/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml

@@ -12,9 +12,9 @@ description: The following analytic identifies native living off the land binari
   regedit.exe) and DotNet binaries. It also does not include the category of OtherMSBinaries.
 data_source:
 - Windows Security 4688
-search: 
+search:
   selection1:
-    process_name:
+    process.file.name:
     - bitsadmin.exe
     - certoc.exe
     - certreq.exe
@@ -96,7 +96,7 @@ search:
     - wuauclt.exe
     - xwizard.exe
   selection2:
-    process_path|re:
+    process.file.path|re:
     - (?i)\\windows\\system32
     - (?i)\\windows\\syswow64
     - (?i)\\windows\\networkcontrolle
@@ -128,24 +128,10 @@ tags:
   - T1036.003
   - T1218
   - T1218.004
-  observable:
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - dest_device_id
-  - process_name
-  - _time
-  - dest_user_id
-  - process_path
-  - process
+  required_fields: []
   kill_chain_phases:
   - Actions on Objectives
   risk_score: 49

dev_ssa/endpoint/ssa___windows_mshta_child_process.yml

@@ -13,7 +13,7 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process_name:
+    process.file.name:
     - wscript.exe
     - cscript.exe
     - searchprotocolhost.exe
@@ -23,7 +23,7 @@ search:
     - scrcons.exe
     - cmd.exe
     - powershell.exe
-    parent_process_name|endswith: mshta.exe
+    actor.process.file.name|endswith: mshta.exe
   condition: selection1
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
@@ -47,34 +47,10 @@ tags:
   mitre_attack_id:
   - T1218.005
   - T1218
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 80

dev_ssa/endpoint/ssa___windows_mshta_command_line_url.yml

@@ -16,10 +16,10 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process|contains:
+    process.cmd_line|contains:
     - https://
     - http://
-    process_name: mshta.exe
+    process.file.name: mshta.exe
   condition: (selection1)
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
@@ -45,34 +45,10 @@ tags:
   mitre_attack_id:
   - T1218.005
   - T1218
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 80

dev_ssa/endpoint/ssa___windows_mshta_inline_hta_execution.yml

@@ -14,11 +14,11 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process|contains:
+    process.cmd_line|contains:
     - about
     - javascript
     - vbscript
-    process_name: mshta.exe
+    process.file.name: mshta.exe
   condition: (selection1)
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
@@ -44,34 +44,10 @@ tags:
   mitre_attack_id:
   - T1218.005
   - T1218
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 80

dev_ssa/endpoint/ssa___windows_odbcconf_load_response_file.yml

@@ -14,12 +14,12 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process|contains:
+    process.cmd_line|contains:
     - '/f '
     - '-f '
-    process_name: odbcconf.exe
+    process.file.name: odbcconf.exe
   selection2:
-    process|contains: .rsp
+    process.cmd_line|contains: .rsp
   condition: (selection1) and selection2
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
@@ -41,30 +41,10 @@ tags:
   mitre_attack_id:
   - T1218.008
   - T1218
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 42

dev_ssa/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml

@@ -20,11 +20,11 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process_name: ntdsutil.exe
+    process.file.name: ntdsutil.exe
   selection2:
-    process|contains: create
+    process.cmd_line|contains: create
   selection3:
-    process|contains: ntds
+    process.cmd_line|contains: ntds
   condition: selection1 and (selection2 and selection3)
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
@@ -50,30 +50,10 @@ tags:
   mitre_attack_id:
   - T1003.003
   - T1003
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 50

dev_ssa/endpoint/ssa___windows_os_credential_dumping_with_procdump.yml

@@ -19,14 +19,14 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process|contains:
+    process.cmd_line|contains:
     - '-ma '
     - '-mm '
-    process_name:
+    process.file.name:
     - procdump64.exe
     - procdump.exe
   selection2:
-    process|contains: lsass
+    process.cmd_line|contains: lsass
   condition: (selection1) and selection2
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
@@ -49,30 +49,10 @@ tags:
   mitre_attack_id:
   - T1003.001
   - T1003
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 80

dev_ssa/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml

@@ -18,7 +18,7 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process_name:
+    process.file.name:
     - powershell_ise.exe
     - powershell.exe
     - sqltoolsps.exe
@@ -26,7 +26,7 @@ search:
     - pwsh.exe
     - pwsh.exe
   selection2:
-    process|re: '(?i)[\-|\/]w(in*d*o*w*s*t*y*l*e*)*\s+[^-]'
+    process.cmd_line|re: (?i)[\-|\/]w(in*d*o*w*s*t*y*l*e*)*\s+[^-]
   condition: selection1 and not selection2
 how_to_implement: You must be ingesting data that records process activity from your
   hosts to populate the Endpoint data model in the Processes node. You must also be
@@ -55,34 +55,10 @@ tags:
     $dest$ executed by user $user$.
   mitre_attack_id:
   - T1020
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 35

dev_ssa/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml

@@ -14,12 +14,12 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   alike use may abuse Get-ADUSer to enumerate these accounts and attempt to crack
   their passwords offline.
 data_source:
-- Windows Security 4688
+- Powershell 4104
 search:
   selection1:
-    process|contains: '4194304'
+    process.cmd_line|contains: '4194304'
   selection2:
-    process|re: get-aduser
+    process.cmd_line|re: get-aduser
   condition: selection1 and selection2
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -40,22 +40,10 @@ tags:
   mitre_attack_id:
   - T1558
   - T1558.004
-  observable:
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 54

dev_ssa/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml

@@ -14,12 +14,12 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   Red Teams and adversaries alike use may leverage PowerView to enumerate these accounts
   and attempt to crack their passwords offline.
 data_source:
-- Windows Security 4688
+- Powershell 4104
 search:
   selection1:
-    process|re: preauthnotrequired
+    process.cmd_line|re: preauthnotrequired
   selection2:
-    process|re: get-domainuser
+    process.cmd_line|re: get-domainuser
   condition: selection1 and selection2
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -39,22 +39,10 @@ tags:
   mitre_attack_id:
   - T1558
   - T1558.004
-  observable:
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 54

dev_ssa/endpoint/ssa___windows_powershell_downloadfile.yml

@@ -14,7 +14,7 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process_name:
+    process.file.name:
     - powershell_ise.exe
     - powershell.exe
     - sqltoolsps.exe
@@ -22,7 +22,7 @@ search:
     - pwsh.exe
     - pwsh.exe
   selection2:
-    process|re: downloadfile
+    process.cmd_line|re: downloadfile
   condition: selection1 and selection2
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
@@ -49,34 +49,10 @@ tags:
     within PowerShell.
   mitre_attack_id:
   - T1020
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 35

dev_ssa/endpoint/ssa___windows_powershell_start_bitstransfer.yml

@@ -16,7 +16,7 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process_name:
+    process.file.name:
     - powershell_ise.exe
     - powershell.exe
     - sqltoolsps.exe
@@ -24,7 +24,7 @@ search:
     - pwsh.exe
     - pwsh.exe
   selection2:
-    process|re: start-bitstransfer
+    process.cmd_line|re: start-bitstransfer
   condition: selection1 and selection2
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
@@ -47,34 +47,10 @@ tags:
   mitre_attack_id:
   - T1197
   - T1105
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 49

dev_ssa/endpoint/ssa___windows_rasautou_dll_execution.yml

@@ -13,11 +13,11 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process_name: rasautou.exe
+    process.file.name: rasautou.exe
   selection2:
-    process|re: '-p '
+    process.cmd_line|re: '-p '
   selection3:
-    process|re: '-d '
+    process.cmd_line|re: '-d '
   condition: selection1 and selection2 and selection3
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
@@ -44,34 +44,10 @@ tags:
   - T1055.001
   - T1218
   - T1055
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 80

dev_ssa/endpoint/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml

@@ -13,9 +13,9 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process_name: acccheckconsole.exe
+    process.file.name: acccheckconsole.exe
   selection2:
-    process_path|re: \\program files (x86)\\windows kits\\10\\bin\\10.0.22000.0\\arm64\\accchecker
+    process.file.path|re: \\program files (x86)\\windows kits\\10\\bin\\10.0.22000.0\\arm64\\accchecker
   condition: selection1 and not selection2
 how_to_implement: To successfully implement this search, you must be ingesting logs
   with the process name, command-line arguments, and parent processes from your endpoints.
@@ -39,23 +39,10 @@ tags:
   mitre_attack_id:
   - T1036
   - T1036.003
-  observable:
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - dest_device_id
-  - process_name
-  - _time
-  - dest_user_id
-  - process_path
+  required_fields: []
   kill_chain_phases:
   - Actions on Objectives
   risk_score: 14

dev_ssa/endpoint/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml

@@ -13,9 +13,9 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process_name: adplus.exe
+    process.file.name: adplus.exe
   selection2:
-    process_path|re: \\program files (x86)\\windows kits\\10\\debuggers\\x86
+    process.file.path|re: \\program files (x86)\\windows kits\\10\\debuggers\\x86
   condition: selection1 and not selection2
 how_to_implement: To successfully implement this search, you must be ingesting logs
   with the process name, command-line arguments, and parent processes from your endpoints.
@@ -39,23 +39,10 @@ tags:
   mitre_attack_id:
   - T1036
   - T1036.003
-  observable:
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - dest_device_id
-  - process_name
-  - _time
-  - dest_user_id
-  - process_path
+  required_fields: []
   kill_chain_phases:
   - Actions on Objectives
   risk_score: 14

dev_ssa/endpoint/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml

@@ -13,9 +13,9 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process_name: advpack.dll
+    process.file.name: advpack.dll
   selection2:
-    process_path|re: \\windows\\syswow64
+    process.file.path|re: \\windows\\syswow64
   condition: selection1 and not selection2
 how_to_implement: To successfully implement this search, you must be ingesting logs
   with the process name, command-line arguments, and parent processes from your endpoints.
@@ -39,23 +39,10 @@ tags:
   mitre_attack_id:
   - T1036
   - T1036.003
-  observable:
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - dest_device_id
-  - process_name
-  - _time
-  - dest_user_id
-  - process_path
+  required_fields: []
   kill_chain_phases:
   - Actions on Objectives
   risk_score: 14

dev_ssa/endpoint/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml

@@ -13,9 +13,9 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process_name: agentexecutor.exe
+    process.file.name: agentexecutor.exe
   selection2:
-    process_path|re: \\program files (x86)
+    process.file.path|re: \\program files (x86)
   condition: selection1 and not selection2
 how_to_implement: To successfully implement this search, you must be ingesting logs
   with the process name, command-line arguments, and parent processes from your endpoints.
@@ -39,23 +39,10 @@ tags:
   mitre_attack_id:
   - T1036
   - T1036.003
-  observable:
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - dest_device_id
-  - process_name
-  - _time
-  - dest_user_id
-  - process_path
+  required_fields: []
   kill_chain_phases:
   - Actions on Objectives
   risk_score: 14

dev_ssa/endpoint/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml

@@ -13,9 +13,9 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process_name: appinstaller.exe
+    process.file.name: appinstaller.exe
   selection2:
-    process_path|re: \\program files\\windowsapps\\microsoft.desktopappinstaller_1.11.2521.0_x64__8wekyb3d8bbwe
+    process.file.path|re: \\program files\\windowsapps\\microsoft.desktopappinstaller_1.11.2521.0_x64__8wekyb3d8bbwe
   condition: selection1 and not selection2
 how_to_implement: To successfully implement this search, you must be ingesting logs
   with the process name, command-line arguments, and parent processes from your endpoints.
@@ -39,23 +39,10 @@ tags:
   mitre_attack_id:
   - T1036
   - T1036.003
-  observable:
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - dest_device_id
-  - process_name
-  - _time
-  - dest_user_id
-  - process_path
+  required_fields: []
   kill_chain_phases:
   - Actions on Objectives
   risk_score: 14

dev_ssa/endpoint/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml

@@ -13,9 +13,9 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process_name: appvlp.exe
+    process.file.name: appvlp.exe
   selection2:
-    process_path|re: \\program files (x86)\\microsoft office\\root\\client
+    process.file.path|re: \\program files (x86)\\microsoft office\\root\\client
   condition: selection1 and not selection2
 how_to_implement: To successfully implement this search, you must be ingesting logs
   with the process name, command-line arguments, and parent processes from your endpoints.
@@ -39,23 +39,10 @@ tags:
   mitre_attack_id:
   - T1036
   - T1036.003
-  observable:
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - dest_device_id
-  - process_name
-  - _time
-  - dest_user_id
-  - process_path
+  required_fields: []
   kill_chain_phases:
   - Actions on Objectives
   risk_score: 14

dev_ssa/endpoint/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml

@@ -13,9 +13,9 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process_name: aspnet_compiler.exe
+    process.file.name: aspnet_compiler.exe
   selection2:
-    process_path|re: \\windows\\microsoft.net\\framework64\\v4.0.30319
+    process.file.path|re: \\windows\\microsoft.net\\framework64\\v4.0.30319
   condition: selection1 and not selection2
 how_to_implement: To successfully implement this search, you must be ingesting logs
   with the process name, command-line arguments, and parent processes from your endpoints.
@@ -39,23 +39,10 @@ tags:
   mitre_attack_id:
   - T1036
   - T1036.003
-  observable:
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - dest_device_id
-  - process_name
-  - _time
-  - dest_user_id
-  - process_path
+  required_fields: []
   kill_chain_phases:
   - Actions on Objectives
   risk_score: 14

dev_ssa/endpoint/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml

@@ -13,9 +13,9 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process_name: at.exe
+    process.file.name: at.exe
   selection2:
-    process_path|re: \\windows\\syswow64
+    process.file.path|re: \\windows\\syswow64
   condition: selection1 and not selection2
 how_to_implement: To successfully implement this search, you must be ingesting logs
   with the process name, command-line arguments, and parent processes from your endpoints.
@@ -39,23 +39,10 @@ tags:
   mitre_attack_id:
   - T1036
   - T1036.003
-  observable:
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - dest_device_id
-  - process_name
-  - _time
-  - dest_user_id
-  - process_path
+  required_fields: []
   kill_chain_phases:
   - Actions on Objectives
   risk_score: 14

dev_ssa/endpoint/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml

@@ -13,9 +13,9 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process_name: atbroker.exe
+    process.file.name: atbroker.exe
   selection2:
-    process_path|re: \\windows\\syswow64
+    process.file.path|re: \\windows\\syswow64
   condition: selection1 and not selection2
 how_to_implement: To successfully implement this search, you must be ingesting logs
   with the process name, command-line arguments, and parent processes from your endpoints.
@@ -39,23 +39,10 @@ tags:
   mitre_attack_id:
   - T1036
   - T1036.003
-  observable:
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - dest_device_id
-  - process_name
-  - _time
-  - dest_user_id
-  - process_path
+  required_fields: []
   kill_chain_phases:
   - Actions on Objectives
   risk_score: 14

dev_ssa/endpoint/ssa___windows_rundll32_comsvcs_memory_dump.yml

@@ -12,10 +12,10 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process|re: minidump
-    process_name: 'rundll32.exe'
+    process.cmd_line|re: minidump
+    process.file.name: rundll32.exe
   selection2:
-    process|re: comsvcs.dll
+    process.cmd_line|re: comsvcs.dll
   condition: selection1 and selection2
 how_to_implement: You must be ingesting endpoint data that tracks process activity,
   including Windows command line logging. You can see how we test this with [Event
@@ -37,23 +37,10 @@ tags:
   mitre_attack_id:
   - T1003.003
   - T1003
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Actor
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - process_name
-  - _tenant
-  - _time
-  - dest_device_id
-  - process
+  required_fields: []
   kill_chain_phases:
   - Actions on Objectives
   risk_score: 40

dev_ssa/endpoint/ssa___windows_rundll32_inline_hta_execution.yml

@@ -16,11 +16,11 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process|contains:
+    process.cmd_line|contains:
     - about
     - javascript
     - vbscript
-    process_name: rundll32.exe
+    process.file.name: rundll32.exe
   condition: selection1
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
@@ -45,34 +45,10 @@ tags:
   mitre_attack_id:
   - T1218
   - T1218.005
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 56

dev_ssa/endpoint/ssa___windows_script_host_spawn_msbuild.yml

@@ -15,10 +15,10 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process_name: MSBuild.exe
-    parent_process_name|re:
-    - 'cscript.exe'
-    - 'wscript.exe'
+    process.file.name: MSBuild.exe
+    actor.process.file.name|re:
+    - cscript.exe
+    - wscript.exe
   condition: selection1
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
@@ -42,34 +42,10 @@ tags:
   mitre_attack_id:
   - T1127.001
   - T1127
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process Name
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 80

dev_ssa/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml

@@ -15,8 +15,8 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process|contains: -decompile
-    process_name: hh.exe
+    process.cmd_line|contains: -decompile
+    process.file.name: hh.exe
   condition: selection1
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
@@ -40,30 +40,10 @@ tags:
   mitre_attack_id:
   - T1218.001
   - T1218
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 90

dev_ssa/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml

@@ -20,10 +20,10 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process|contains:
+    process.cmd_line|contains:
     - https://
     - http://
-    process_name: hh.exe
+    process.file.name: hh.exe
   condition: (selection1)
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
@@ -50,30 +50,10 @@ tags:
   mitre_attack_id:
   - T1218.001
   - T1218
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 90

dev_ssa/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml

@@ -23,10 +23,10 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process|contains:
+    process.cmd_line|contains:
     - 'mk:@MSITStore:'
     - 'its:'
-    process_name: hh.exe
+    process.file.name: hh.exe
   condition: (selection1)
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
@@ -53,30 +53,10 @@ tags:
   mitre_attack_id:
   - T1218.001
   - T1218
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 72

dev_ssa/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml

@@ -12,10 +12,10 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process|contains:
+    process.cmd_line|contains:
     - '-y '
     - '/y '
-    process_name: msiexec.exe
+    process.file.name: msiexec.exe
   condition: (selection1)
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
@@ -36,30 +36,10 @@ tags:
     by user $dest_user_id$ attempting to register a file.
   mitre_attack_id:
   - T1218.007
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 35

dev_ssa/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml

@@ -12,10 +12,10 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process|contains:
+    process.cmd_line|contains:
     - https://
     - http://
-    process_name: msiexec.exe
+    process.file.name: msiexec.exe
   condition: (selection1)
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
@@ -36,30 +36,10 @@ tags:
     by user $dest_user_id$ attempting to download a file.
   mitre_attack_id:
   - T1218.007
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 35

dev_ssa/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml

@@ -12,10 +12,10 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process|contains:
+    process.cmd_line|contains:
     - '-z '
     - '/z '
-    process_name: msiexec.exe
+    process.file.name: msiexec.exe
   condition: (selection1)
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
@@ -36,30 +36,10 @@ tags:
     by user $dest_user_id$ attempting to unregister a DLL.
   mitre_attack_id:
   - T1218.007
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 35

dev_ssa/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml

@@ -16,8 +16,8 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process_name: MSBuild.exe
-    parent_process_name|re: wmiprvse.exe
+    process.file.name: MSBuild.exe
+    actor.process.file.name|re: wmiprvse.exe
   condition: selection1
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
@@ -41,34 +41,10 @@ tags:
   mitre_attack_id:
   - T1127
   - T1127.001
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process Name
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 80

dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml

@@ -11,18 +11,18 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
   null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
   | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
-  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
-  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
-  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
-  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
-  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
-  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
-  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
-  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
-  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  (process_file_name="WinRAR.exe" OR like(process_file_name, "7z%") OR like(process_file_name,
-  "winzip%")) AND (like(actor_process_file_name, "%powershell.exe") OR like(actor_process_file_name,
-  "%cmd.exe")) 
+  actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
+  "map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
+  "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
+  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
+  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
+  any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
+  "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
+  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
+  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
+  null) | where (process_file_name="WinRAR.exe" OR like(process_file_name, "7z%")
+  OR like(process_file_name, "winzip%")) AND (like(actor_process_file_name, "%powershell.exe")
+  OR like(actor_process_file_name, "%cmd.exe")) 
   | eval body=create_map(
     "devices", [
         create_map(
@@ -30,11 +30,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
         )
     ],
     "time", timestamp,
-    "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.process.file.name", actor_process_file_name),
-    "message", concat("Anomalous usage of Archive Tools has been triggered on ", device_hostname, " by ", process_user_name, "."),
+    "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
+    "message", concat("Anomalous usage of Archive Tools has been triggered on ", device_hostname, " by ", actor_user_name, "."),
     "users", [
         create_map(
-            "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null)
+            "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
         )
     ],
     "activity_id", 1,
@@ -59,11 +59,15 @@ references:
 - https://attack.mitre.org/techniques/T1560/001/
 tags:
   required_fields:
-  - process.user.name
-  - device.hostname
+  - process.pid
+  - process.file.path
   - process.file.name
   - process.cmd_line
+  - actor.user.name
+  - actor.process.pid
+  - actor.process.file.path
   - actor.process.file.name
+  - device.hostname
   risk_score: 42
   security_domain: endpoint
   risk_severity: low
@@ -78,7 +82,7 @@ tags:
     cim: process_name
   - ocsf: process.cmd_line
     cim: process
-  - ocsf: process.user.name
+  - ocsf: actor.user.name
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id

dist/ssa/srs/ssa___attempt_to_delete_services.yml

@@ -14,16 +14,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
   null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
   | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
-  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
-  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
-  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
-  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
-  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
-  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
-  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
-  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
-  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  like(process_cmd_line, "%delete%") AND process_file_name="sc.exe" 
+  actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
+  "map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
+  "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
+  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
+  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
+  any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
+  "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
+  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
+  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
+  null) | where process_file_name="sc.exe" AND like(process_cmd_line, "%delete%")
+  
   | eval body=create_map(
     "devices", [
         create_map(
@@ -31,11 +32,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
         )
     ],
     "time", timestamp,
-    "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line),
-    "message", concat("Attempt To Delete Services has been triggered on ", device_hostname, " by ", process_user_name, "."),
+    "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
+    "message", concat("Attempt To Delete Services has been triggered on ", device_hostname, " by ", actor_user_name, "."),
     "users", [
         create_map(
-            "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null)
+            "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
         )
     ],
     "activity_id", 1,
@@ -62,10 +63,15 @@ references:
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1543.003/T1543.003.md
 tags:
   required_fields:
-  - process.user.name
-  - device.hostname
+  - process.pid
+  - process.file.path
   - process.file.name
   - process.cmd_line
+  - actor.user.name
+  - actor.process.pid
+  - actor.process.file.path
+  - actor.process.file.name
+  - device.hostname
   risk_score: 36
   security_domain: endpoint
   risk_severity: low
@@ -80,7 +86,7 @@ tags:
     cim: process_name
   - ocsf: process.cmd_line
     cim: process
-  - ocsf: process.user.name
+  - ocsf: actor.user.name
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id

dist/ssa/srs/ssa___attempt_to_disable_services.yml

@@ -14,17 +14,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
   null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
   | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
-  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
-  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
-  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
-  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
-  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
-  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
-  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
-  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
-  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  like(process_cmd_line, "%config%") AND like(process_cmd_line, "%disabled%") AND
-  process_file_name="sc.exe" 
+  actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
+  "map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
+  "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
+  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
+  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
+  any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
+  "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
+  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
+  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
+  null) | where like(process_cmd_line, "%config%") AND like(process_cmd_line, "%disabled%")
+  AND process_file_name="sc.exe" 
   | eval body=create_map(
     "devices", [
         create_map(
@@ -32,11 +32,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
         )
     ],
     "time", timestamp,
-    "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line),
-    "message", concat("Attempt To Disable Services has been triggered on ", device_hostname, " by ", process_user_name, "."),
+    "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
+    "message", concat("Attempt To Disable Services has been triggered on ", device_hostname, " by ", actor_user_name, "."),
     "users", [
         create_map(
-            "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null)
+            "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
         )
     ],
     "activity_id", 1,
@@ -64,10 +64,15 @@ references:
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-14---disable-arbitrary-security-windows-service
 tags:
   required_fields:
-  - process.user.name
-  - device.hostname
+  - process.pid
+  - process.file.path
   - process.file.name
   - process.cmd_line
+  - actor.user.name
+  - actor.process.pid
+  - actor.process.file.path
+  - actor.process.file.name
+  - device.hostname
   risk_score: 36
   security_domain: endpoint
   risk_severity: low
@@ -82,7 +87,7 @@ tags:
     cim: process_name
   - ocsf: process.cmd_line
     cim: process
-  - ocsf: process.user.name
+  - ocsf: actor.user.name
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id

dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml

@@ -12,16 +12,16 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
   null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
   | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
-  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
-  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
-  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
-  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
-  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
-  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
-  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
-  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
-  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  (process_file_name="reg.exe" OR process_file_name="cmd.exe") AND (match_regex(process_cmd_line,
+  actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
+  "map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
+  "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
+  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
+  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
+  any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
+  "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
+  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
+  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
+  null) | where (process_file_name="reg.exe" OR process_file_name="cmd.exe") AND (match_regex(process_cmd_line,
   /(?i)HKEY_LOCAL_MACHINE\\System/)=true OR match_regex(process_cmd_line, /(?i)HKEY_LOCAL_MACHINE\\SAM/)=true
   OR match_regex(process_cmd_line, /(?i)HKEY_LOCAL_MACHINE\\Security/)=true OR match_regex(process_cmd_line,
   /(?i)HKLM\\System/)=true OR match_regex(process_cmd_line, /(?i)HKLM\\SAM/)=true
@@ -34,11 +34,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
         )
     ],
     "time", timestamp,
-    "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line),
-    "message", concat("Attempted Credential Dump From Registry via Reg exe has been triggered on ", device_hostname, " by ", process_user_name, "."),
+    "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
+    "message", concat("Attempted Credential Dump From Registry via Reg exe has been triggered on ", device_hostname, " by ", actor_user_name, "."),
     "users", [
         create_map(
-            "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null)
+            "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
         )
     ],
     "activity_id", 1,
@@ -64,10 +64,15 @@ references:
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets
 tags:
   required_fields:
-  - process.user.name
-  - device.hostname
+  - process.pid
+  - process.file.path
   - process.file.name
   - process.cmd_line
+  - actor.user.name
+  - actor.process.pid
+  - actor.process.file.path
+  - actor.process.file.name
+  - device.hostname
   risk_score: 63
   security_domain: endpoint
   risk_severity: medium
@@ -82,7 +87,7 @@ tags:
     cim: process_name
   - ocsf: process.cmd_line
     cim: process
-  - ocsf: process.user.name
+  - ocsf: actor.user.name
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id

dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml

@@ -12,17 +12,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
   null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
   | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
-  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
-  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
-  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
-  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
-  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
-  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
-  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
-  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
-  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  process_file_name="bcdedit.exe" AND (like(process_cmd_line, "%no%") AND like(process_cmd_line,
-  "%recoveryenabled%")) 
+  actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
+  "map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
+  "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
+  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
+  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
+  any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
+  "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
+  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
+  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
+  null) | where process_file_name="bcdedit.exe" AND (like(process_cmd_line, "%no%")
+  AND like(process_cmd_line, "%recoveryenabled%")) 
   | eval body=create_map(
     "devices", [
         create_map(
@@ -30,11 +30,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
         )
     ],
     "time", timestamp,
-    "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line),
-    "message", concat("BCDEdit Failure Recovery Modification has been triggered on ", device_hostname, " by ", process_user_name, "."),
+    "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
+    "message", concat("BCDEdit Failure Recovery Modification has been triggered on ", device_hostname, " by ", actor_user_name, "."),
     "users", [
         create_map(
-            "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null)
+            "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
         )
     ],
     "activity_id", 1,
@@ -58,10 +58,15 @@ references:
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-4---windows---disable-windows-recovery-console-repair
 tags:
   required_fields:
-  - process.user.name
-  - device.hostname
+  - process.pid
+  - process.file.path
   - process.file.name
   - process.cmd_line
+  - actor.user.name
+  - actor.process.pid
+  - actor.process.file.path
+  - actor.process.file.name
+  - device.hostname
   risk_score: 80
   security_domain: endpoint
   risk_severity: high
@@ -76,7 +81,7 @@ tags:
     cim: process_name
   - ocsf: process.cmd_line
     cim: process
-  - ocsf: process.user.name
+  - ocsf: actor.user.name
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id

dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml

@@ -12,16 +12,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
   null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
   | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
-  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
-  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
-  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
-  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
-  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
-  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
-  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
-  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
-  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  like(process_cmd_line, "%/W:%") AND process_file_name="cipher.exe" 
+  actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
+  "map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
+  "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
+  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
+  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
+  any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
+  "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
+  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
+  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
+  null) | where process_file_name="cipher.exe" AND like(process_cmd_line, "%/W:%")
+  
   | eval body=create_map(
     "devices", [
         create_map(
@@ -29,11 +30,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
         )
     ],
     "time", timestamp,
-    "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line),
-    "message", concat("Clear Unallocated Sector Using Cipher App has been triggered on ", device_hostname, " by ", process_user_name, "."),
+    "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
+    "message", concat("Clear Unallocated Sector Using Cipher App has been triggered on ", device_hostname, " by ", actor_user_name, "."),
     "users", [
         create_map(
-            "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null)
+            "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
         )
     ],
     "activity_id", 1,
@@ -58,10 +59,15 @@ references:
 - https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/sophoslabs-ransomware-behavior-report.pdf
 tags:
   required_fields:
-  - process.user.name
-  - device.hostname
+  - process.pid
+  - process.file.path
   - process.file.name
   - process.cmd_line
+  - actor.user.name
+  - actor.process.pid
+  - actor.process.file.path
+  - actor.process.file.name
+  - device.hostname
   risk_score: 90
   security_domain: endpoint
   risk_severity: high
@@ -76,7 +82,7 @@ tags:
     cim: process_name
   - ocsf: process.cmd_line
     cim: process
-  - ocsf: process.user.name
+  - ocsf: actor.user.name
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id

dist/ssa/srs/ssa___delete_a_net_user.yml

@@ -15,17 +15,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
   null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
   | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
-  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
-  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
-  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
-  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
-  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
-  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
-  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
-  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
-  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  like(process_cmd_line, "%user%") AND like(process_cmd_line, "%/delete%") AND (process_file_name="net.exe"
-  OR process_file_name="net1.exe") 
+  actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
+  "map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
+  "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
+  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
+  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
+  any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
+  "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
+  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
+  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
+  null) | where like(process_cmd_line, "%user%") AND like(process_cmd_line, "%/delete%")
+  AND (process_file_name="net.exe" OR process_file_name="net1.exe") 
   | eval body=create_map(
     "devices", [
         create_map(
@@ -33,11 +33,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
         )
     ],
     "time", timestamp,
-    "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line),
-    "message", concat("Delete A Net User has been triggered on ", device_hostname, " by ", process_user_name, "."),
+    "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
+    "message", concat("Delete A Net User has been triggered on ", device_hostname, " by ", actor_user_name, "."),
     "users", [
         create_map(
-            "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null)
+            "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
         )
     ],
     "activity_id", 1,
@@ -63,10 +63,15 @@ references:
 - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
 tags:
   required_fields:
-  - process.user.name
-  - device.hostname
+  - process.pid
+  - process.file.path
   - process.file.name
   - process.cmd_line
+  - actor.user.name
+  - actor.process.pid
+  - actor.process.file.path
+  - actor.process.file.name
+  - device.hostname
   risk_score: 49
   security_domain: endpoint
   risk_severity: low
@@ -81,7 +86,7 @@ tags:
     cim: process_name
   - ocsf: process.cmd_line
     cim: process
-  - ocsf: process.user.name
+  - ocsf: actor.user.name
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id

dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml

@@ -13,17 +13,18 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
   null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
   | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
-  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
-  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
-  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
-  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
-  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
-  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
-  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
-  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
-  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  match_regex(process_cmd_line, /(?i)deny/)=true AND (process_file_name="icacls.exe"
-  OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe") 
+  actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
+  "map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
+  "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
+  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
+  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
+  any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
+  "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
+  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
+  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
+  null) | where (process_file_name="icacls.exe" OR process_file_name="xcacls.exe"
+  OR process_file_name="cacls.exe") AND match_regex(process_cmd_line, /(?i)deny/)=true
+  
   | eval body=create_map(
     "devices", [
         create_map(
@@ -31,11 +32,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
         )
     ],
     "time", timestamp,
-    "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line),
-    "message", concat("Deny Permission using Cacls Utility has been triggered on ", device_hostname, " by ", process_user_name, "."),
+    "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
+    "message", concat("Deny Permission using Cacls Utility has been triggered on ", device_hostname, " by ", actor_user_name, "."),
     "users", [
         create_map(
-            "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null)
+            "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
         )
     ],
     "activity_id", 1,
@@ -61,10 +62,15 @@ references:
 - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
 tags:
   required_fields:
-  - process.user.name
-  - device.hostname
+  - process.pid
+  - process.file.path
   - process.file.name
   - process.cmd_line
+  - actor.user.name
+  - actor.process.pid
+  - actor.process.file.path
+  - actor.process.file.name
+  - device.hostname
   risk_score: 35
   security_domain: endpoint
   risk_severity: low
@@ -79,7 +85,7 @@ tags:
     cim: process_name
   - ocsf: process.cmd_line
     cim: process
-  - ocsf: process.user.name
+  - ocsf: actor.user.name
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id

dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml

@@ -13,18 +13,18 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
   null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
   | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
-  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
-  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
-  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
-  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
-  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
-  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
-  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
-  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
-  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  (actor_process_file_name="winword.exe" OR actor_process_file_name="excel.exe" OR
-  actor_process_file_name="outlook.exe" OR actor_process_file_name="acrobat.exe" OR
-  actor_process_file_name="acrord32.exe" OR actor_process_file_name="iexplore.exe"
+  actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
+  "map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
+  "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
+  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
+  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
+  any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
+  "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
+  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
+  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
+  null) | where (actor_process_file_name="winword.exe" OR actor_process_file_name="excel.exe"
+  OR actor_process_file_name="outlook.exe" OR actor_process_file_name="acrobat.exe"
+  OR actor_process_file_name="acrord32.exe" OR actor_process_file_name="iexplore.exe"
   OR actor_process_file_name="opera.exe" OR actor_process_file_name="firefox.exe"
   OR actor_process_file_name="powershell.exe") OR (actor_process_file_name="java.exe"
   AND (NOT match_regex(actor_process_file_name, /(?i)patch1-Hotfix1a/)=true)) OR (actor_process_file_name="chrome.exe"
@@ -36,11 +36,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
         )
     ],
     "time", timestamp,
-    "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.cmd_line", process_cmd_line, "actor.process.file.name", actor_process_file_name),
-    "message", concat("Detect Prohibited Applications Spawning cmd exe has been triggered on ", device_hostname, " by ", process_user_name, "."),
+    "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
+    "message", concat("Detect Prohibited Applications Spawning cmd exe has been triggered on ", device_hostname, " by ", actor_user_name, "."),
     "users", [
         create_map(
-            "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null)
+            "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
         )
     ],
     "activity_id", 1,
@@ -65,10 +65,15 @@ references:
 - https://attack.mitre.org/techniques/T1059/
 tags:
   required_fields:
-  - process.user.name
-  - device.hostname
+  - process.pid
+  - process.file.path
+  - process.file.name
   - process.cmd_line
+  - actor.user.name
+  - actor.process.pid
+  - actor.process.file.path
   - actor.process.file.name
+  - device.hostname
   risk_score: 35
   security_domain: endpoint
   risk_severity: low
@@ -83,7 +88,7 @@ tags:
     cim: process_name
   - ocsf: process.cmd_line
     cim: process
-  - ocsf: process.user.name
+  - ocsf: actor.user.name
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id

dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml

@@ -16,21 +16,22 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
   null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
   | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
-  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
-  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
-  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
-  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
-  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
-  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
-  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
-  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
-  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  (like(process_cmd_line, "%--multi-thread-streams%") OR like(process_cmd_line, "%--transfers%")
-  OR like(process_cmd_line, "%--auto-confirm%") OR like(process_cmd_line, "%--ignore-existing%")
-  OR like(process_cmd_line, "%--no-check-certificate%") OR like(process_cmd_line,
-  "%--progress%") OR like(process_cmd_line, "%--config%") OR like(process_cmd_line,
-  "%ftp%") OR like(process_cmd_line, "%pcloud%") OR like(process_cmd_line, "%mega%")
-  OR like(process_cmd_line, "%copy%")) AND process_file_name="rclone.exe" 
+  actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
+  "map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
+  "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
+  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
+  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
+  any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
+  "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
+  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
+  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
+  null) | where (like(process_cmd_line, "%--multi-thread-streams%") OR like(process_cmd_line,
+  "%--transfers%") OR like(process_cmd_line, "%--auto-confirm%") OR like(process_cmd_line,
+  "%--ignore-existing%") OR like(process_cmd_line, "%--no-check-certificate%") OR
+  like(process_cmd_line, "%--progress%") OR like(process_cmd_line, "%--config%") OR
+  like(process_cmd_line, "%ftp%") OR like(process_cmd_line, "%pcloud%") OR like(process_cmd_line,
+  "%mega%") OR like(process_cmd_line, "%copy%")) AND process_file_name="rclone.exe"
+  
   | eval body=create_map(
     "devices", [
         create_map(
@@ -38,11 +39,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
         )
     ],
     "time", timestamp,
-    "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line),
-    "message", concat("Detect RClone Command-Line Usage has been triggered on ", device_hostname, " by ", process_user_name, "."),
+    "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
+    "message", concat("Detect RClone Command-Line Usage has been triggered on ", device_hostname, " by ", actor_user_name, "."),
     "users", [
         create_map(
-            "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null)
+            "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
         )
     ],
     "activity_id", 1,
@@ -70,10 +71,15 @@ references:
 - https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/
 tags:
   required_fields:
-  - process.user.name
-  - device.hostname
+  - process.pid
+  - process.file.path
   - process.file.name
   - process.cmd_line
+  - actor.user.name
+  - actor.process.pid
+  - actor.process.file.path
+  - actor.process.file.name
+  - device.hostname
   risk_score: 35
   security_domain: endpoint
   risk_severity: low
@@ -88,7 +94,7 @@ tags:
     cim: process_name
   - ocsf: process.cmd_line
     cim: process
-  - ocsf: process.user.name
+  - ocsf: actor.user.name
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id

dist/ssa/srs/ssa___disable_net_user_account.yml

@@ -13,17 +13,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
   null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
   | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
-  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
-  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
-  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
-  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
-  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
-  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
-  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
-  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
-  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  like(process_cmd_line, "%user%") AND like(process_cmd_line, "%/active:no%") AND
-  (process_file_name="net.exe" OR process_file_name="net1.exe") 
+  actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
+  "map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
+  "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
+  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
+  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
+  any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
+  "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
+  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
+  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
+  null) | where like(process_cmd_line, "%user%") AND like(process_cmd_line, "%/active:no%")
+  AND (process_file_name="net.exe" OR process_file_name="net1.exe") 
   | eval body=create_map(
     "devices", [
         create_map(
@@ -31,11 +31,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
         )
     ],
     "time", timestamp,
-    "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line),
-    "message", concat("Disable Net User Account has been triggered on ", device_hostname, " by ", process_user_name, "."),
+    "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
+    "message", concat("Disable Net User Account has been triggered on ", device_hostname, " by ", actor_user_name, "."),
     "users", [
         create_map(
-            "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null)
+            "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
         )
     ],
     "activity_id", 1,
@@ -62,10 +62,15 @@ references:
 - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
 tags:
   required_fields:
-  - process.user.name
-  - device.hostname
+  - process.pid
+  - process.file.path
   - process.file.name
   - process.cmd_line
+  - actor.user.name
+  - actor.process.pid
+  - actor.process.file.path
+  - actor.process.file.name
+  - device.hostname
   risk_score: 49
   security_domain: endpoint
   risk_severity: low
@@ -80,7 +85,7 @@ tags:
     cim: process_name
   - ocsf: process.cmd_line
     cim: process
-  - ocsf: process.user.name
+  - ocsf: actor.user.name
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id

dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml

@@ -15,18 +15,18 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
   null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
   | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
-  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
-  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
-  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
-  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
-  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
-  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
-  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
-  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
-  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  (like(process_cmd_line, "%-retry=%") OR like(process_cmd_line, "%-type=%") OR like(process_cmd_line,
-  "%-q=%") OR like(process_cmd_line, "%-qt=%") OR like(process_cmd_line, "%-querytype=%"))
-  AND process_file_name="nslookup.exe" 
+  actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
+  "map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
+  "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
+  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
+  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
+  any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
+  "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
+  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
+  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
+  null) | where (like(process_cmd_line, "%-retry=%") OR like(process_cmd_line, "%-type=%")
+  OR like(process_cmd_line, "%-q=%") OR like(process_cmd_line, "%-qt=%") OR like(process_cmd_line,
+  "%-querytype=%")) AND process_file_name="nslookup.exe" 
   | eval body=create_map(
     "devices", [
         create_map(
@@ -34,11 +34,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
         )
     ],
     "time", timestamp,
-    "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line),
-    "message", concat("DNS Exfiltration Using Nslookup App has been triggered on ", device_hostname, " by ", process_user_name, "."),
+    "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
+    "message", concat("DNS Exfiltration Using Nslookup App has been triggered on ", device_hostname, " by ", actor_user_name, "."),
     "users", [
         create_map(
-            "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null)
+            "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
         )
     ],
     "activity_id", 1,
@@ -65,10 +65,15 @@ references:
 - https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
 tags:
   required_fields:
-  - process.user.name
-  - device.hostname
+  - process.pid
+  - process.file.path
   - process.file.name
   - process.cmd_line
+  - actor.user.name
+  - actor.process.pid
+  - actor.process.file.path
+  - actor.process.file.name
+  - device.hostname
   risk_score: 72
   security_domain: endpoint
   risk_severity: medium
@@ -83,7 +88,7 @@ tags:
     cim: process_name
   - ocsf: process.cmd_line
     cim: process
-  - ocsf: process.user.name
+  - ocsf: actor.user.name
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id

dist/ssa/srs/ssa___fsutil_zeroing_file.yml

@@ -12,16 +12,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
   null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
   | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
-  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
-  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
-  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
-  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
-  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
-  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
-  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
-  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
-  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  like(process_cmd_line, "%setzerodata%") AND process_file_name="fsutil.exe" 
+  actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
+  "map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
+  "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
+  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
+  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
+  any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
+  "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
+  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
+  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
+  null) | where like(process_cmd_line, "%setzerodata%") AND process_file_name="fsutil.exe"
+  
   | eval body=create_map(
     "devices", [
         create_map(
@@ -29,11 +30,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
         )
     ],
     "time", timestamp,
-    "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line),
-    "message", concat("Fsutil Zeroing File has been triggered on ", device_hostname, " by ", process_user_name, "."),
+    "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
+    "message", concat("Fsutil Zeroing File has been triggered on ", device_hostname, " by ", actor_user_name, "."),
     "users", [
         create_map(
-            "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null)
+            "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
         )
     ],
     "activity_id", 1,
@@ -60,10 +61,15 @@ references:
 - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-file
 tags:
   required_fields:
-  - process.user.name
-  - device.hostname
+  - process.pid
+  - process.file.path
   - process.file.name
   - process.cmd_line
+  - actor.user.name
+  - actor.process.pid
+  - actor.process.file.path
+  - actor.process.file.name
+  - device.hostname
   risk_score: 54
   security_domain: endpoint
   risk_severity: medium
@@ -78,7 +84,7 @@ tags:
     cim: process_name
   - ocsf: process.cmd_line
     cim: process
-  - ocsf: process.user.name
+  - ocsf: actor.user.name
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id

dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml

@@ -13,17 +13,18 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
   null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
   | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
-  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
-  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
-  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
-  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
-  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
-  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
-  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
-  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
-  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  match_regex(process_cmd_line, /(?i)grant/)=true AND (process_file_name="icacls.exe"
-  OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe") 
+  actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
+  "map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
+  "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
+  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
+  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
+  any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
+  "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
+  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
+  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
+  null) | where (process_file_name="icacls.exe" OR process_file_name="xcacls.exe"
+  OR process_file_name="cacls.exe") AND match_regex(process_cmd_line, /(?i)grant/)=true
+  
   | eval body=create_map(
     "devices", [
         create_map(
@@ -31,11 +32,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
         )
     ],
     "time", timestamp,
-    "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line),
-    "message", concat("Grant Permission Using Cacls Utility has been triggered on ", device_hostname, " by ", process_user_name, "."),
+    "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
+    "message", concat("Grant Permission Using Cacls Utility has been triggered on ", device_hostname, " by ", actor_user_name, "."),
     "users", [
         create_map(
-            "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null)
+            "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
         )
     ],
     "activity_id", 1,
@@ -61,10 +62,15 @@ references:
 - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
 tags:
   required_fields:
-  - process.user.name
-  - device.hostname
+  - process.pid
+  - process.file.path
   - process.file.name
   - process.cmd_line
+  - actor.user.name
+  - actor.process.pid
+  - actor.process.file.path
+  - actor.process.file.name
+  - device.hostname
   risk_score: 35
   security_domain: endpoint
   risk_severity: low
@@ -79,7 +85,7 @@ tags:
     cim: process_name
   - ocsf: process.cmd_line
     cim: process
-  - ocsf: process.user.name
+  - ocsf: actor.user.name
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id

dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml

@@ -13,16 +13,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
   null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
   | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
-  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
-  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
-  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
-  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
-  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
-  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
-  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
-  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
-  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  match_regex(process_cmd_line, /(?i)/)=true AND process_file_name="attrib.exe" 
+  actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
+  "map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
+  "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
+  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
+  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
+  any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
+  "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
+  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
+  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
+  null) | where process_file_name="attrib.exe" AND match_regex(process_cmd_line, /(?i)/)=true
+  
   | eval body=create_map(
     "devices", [
         create_map(
@@ -30,11 +31,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
         )
     ],
     "time", timestamp,
-    "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line),
-    "message", concat("Hiding Files And Directories With Attrib exe has been triggered on ", device_hostname, " by ", process_user_name, "."),
+    "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
+    "message", concat("Hiding Files And Directories With Attrib exe has been triggered on ", device_hostname, " by ", actor_user_name, "."),
     "users", [
         create_map(
-            "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null)
+            "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
         )
     ],
     "activity_id", 1,
@@ -61,10 +62,15 @@ references:
 - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/attrib
 tags:
   required_fields:
-  - process.user.name
-  - device.hostname
+  - process.pid
+  - process.file.path
   - process.file.name
   - process.cmd_line
+  - actor.user.name
+  - actor.process.pid
+  - actor.process.file.path
+  - actor.process.file.name
+  - device.hostname
   risk_score: 72
   security_domain: endpoint
   risk_severity: medium
@@ -79,7 +85,7 @@ tags:
     cim: process_name
   - ocsf: process.cmd_line
     cim: process
-  - ocsf: process.user.name
+  - ocsf: actor.user.name
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id

dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml

@@ -15,16 +15,16 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
   null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
   | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
-  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
-  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
-  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
-  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
-  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
-  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
-  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
-  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
-  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  (match_regex(process_cmd_line, /(?i)S-1-1-0:/)=true OR match_regex(process_cmd_line,
+  actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
+  "map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
+  "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
+  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
+  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
+  any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
+  "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
+  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
+  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
+  null) | where (match_regex(process_cmd_line, /(?i)S-1-1-0:/)=true OR match_regex(process_cmd_line,
   /(?i)SYSTEM:/)=true OR match_regex(process_cmd_line, /(?i)everyone:/)=true) AND
   (process_file_name="icacls.exe" OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe")
   
@@ -35,11 +35,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
         )
     ],
     "time", timestamp,
-    "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line),
-    "message", concat("Modify ACLs Permission Of Files Or Folders has been triggered on ", device_hostname, " by ", process_user_name, "."),
+    "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
+    "message", concat("Modify ACLs Permission Of Files Or Folders has been triggered on ", device_hostname, " by ", actor_user_name, "."),
     "users", [
         create_map(
-            "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null)
+            "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
         )
     ],
     "activity_id", 1,
@@ -65,10 +65,15 @@ references:
 - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
 tags:
   required_fields:
-  - process.user.name
-  - device.hostname
+  - process.pid
+  - process.file.path
   - process.file.name
   - process.cmd_line
+  - actor.user.name
+  - actor.process.pid
+  - actor.process.file.path
+  - actor.process.file.name
+  - device.hostname
   risk_score: 35
   security_domain: endpoint
   risk_severity: low
@@ -83,7 +88,7 @@ tags:
     cim: process_name
   - ocsf: process.cmd_line
     cim: process
-  - ocsf: process.user.name
+  - ocsf: actor.user.name
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id

dist/ssa/srs/ssa___office_product_spawning_windows_script_host.yml

@@ -12,20 +12,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
   null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
   | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
-  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
-  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
-  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
-  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
-  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
-  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
-  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
-  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
-  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  (match_regex(actor_process_file_name, /(?i)visio.exe/)=true OR match_regex(actor_process_file_name,
+  actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
+  "map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
+  "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
+  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
+  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
+  any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
+  "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
+  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
+  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
+  null) | where (process_file_name="cscript.exe" OR process_file_name="wscript.exe")
+  AND (match_regex(actor_process_file_name, /(?i)visio.exe/)=true OR match_regex(actor_process_file_name,
   /(?i)mspub.exe/)=true OR match_regex(actor_process_file_name, /(?i)powerpnt.exe/)=true
   OR match_regex(actor_process_file_name, /(?i)excel.exe/)=true OR match_regex(actor_process_file_name,
-  /(?i)winword.exe/)=true) AND (process_file_name="cscript.exe" OR process_file_name="wscript.exe")
-  
+  /(?i)winword.exe/)=true) 
   | eval body=create_map(
     "devices", [
         create_map(
@@ -33,11 +33,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
         )
     ],
     "time", timestamp,
-    "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.process.file.name", actor_process_file_name),
-    "message", concat("Office Product Spawning Windows Script Host has been triggered on ", device_hostname, " by ", process_user_name, "."),
+    "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
+    "message", concat("Office Product Spawning Windows Script Host has been triggered on ", device_hostname, " by ", actor_user_name, "."),
     "users", [
         create_map(
-            "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null)
+            "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
         )
     ],
     "activity_id", 1,
@@ -63,11 +63,15 @@ references:
 - https://blog.cluster25.duskrise.com/2022/09/23/in-the-footsteps-of-the-fancy-bear-powerpoint-graphite/
 tags:
   required_fields:
-  - process.user.name
-  - device.hostname
+  - process.pid
+  - process.file.path
   - process.file.name
   - process.cmd_line
+  - actor.user.name
+  - actor.process.pid
+  - actor.process.file.path
   - actor.process.file.name
+  - device.hostname
   risk_score: 63
   security_domain: endpoint
   risk_severity: medium
@@ -82,7 +86,7 @@ tags:
     cim: process_name
   - ocsf: process.cmd_line
     cim: process
-  - ocsf: process.user.name
+  - ocsf: actor.user.name
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id

dist/ssa/srs/ssa___resize_shadowstorage_volume.yml

@@ -13,17 +13,18 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
   null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
   | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
-  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
-  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
-  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
-  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
-  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
-  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
-  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
-  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
-  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  like(process_cmd_line, "%shadowstorage%") AND like(process_cmd_line, "%resize%")
-  AND like(process_cmd_line, "%maxsize%") AND process_file_name="vssadmin.exe" 
+  actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
+  "map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
+  "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
+  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
+  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
+  any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
+  "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
+  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
+  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
+  null) | where like(process_cmd_line, "%shadowstorage%") AND like(process_cmd_line,
+  "%resize%") AND like(process_cmd_line, "%maxsize%") AND process_file_name="vssadmin.exe"
+  
   | eval body=create_map(
     "devices", [
         create_map(
@@ -31,11 +32,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
         )
     ],
     "time", timestamp,
-    "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line),
-    "message", concat("Resize Shadowstorage Volume has been triggered on ", device_hostname, " by ", process_user_name, "."),
+    "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
+    "message", concat("Resize Shadowstorage Volume has been triggered on ", device_hostname, " by ", actor_user_name, "."),
     "users", [
         create_map(
-            "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null)
+            "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
         )
     ],
     "activity_id", 1,
@@ -62,10 +63,15 @@ references:
 - https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html
 tags:
   required_fields:
-  - process.user.name
-  - device.hostname
+  - process.pid
+  - process.file.path
   - process.file.name
   - process.cmd_line
+  - actor.user.name
+  - actor.process.pid
+  - actor.process.file.path
+  - actor.process.file.name
+  - device.hostname
   risk_score: 64
   security_domain: endpoint
   risk_severity: medium
@@ -80,7 +86,7 @@ tags:
     cim: process_name
   - ocsf: process.cmd_line
     cim: process
-  - ocsf: process.user.name
+  - ocsf: actor.user.name
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id

dist/ssa/srs/ssa___sdelete_application_execution.yml

@@ -14,27 +14,27 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
   null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
   | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
-  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
-  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
-  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
-  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
-  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
-  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
-  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
-  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
-  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  (like(process_cmd_line, "%.xls%") OR like(process_cmd_line, "%.gz%") OR like(process_cmd_line,
-  "%.tar%") OR like(process_cmd_line, "%.rar%") OR like(process_cmd_line, "%.zip%")
-  OR like(process_cmd_line, "%.7z%") OR like(process_cmd_line, "%.bmp%") OR like(process_cmd_line,
-  "%.gif%") OR like(process_cmd_line, "%.png%") OR like(process_cmd_line, "%.jpg%")
-  OR like(process_cmd_line, "%.txt%") OR like(process_cmd_line, "%.log%") OR like(process_cmd_line,
-  "%.key%") OR like(process_cmd_line, "%.pdf%") OR like(process_cmd_line, "%.rtf%")
-  OR like(process_cmd_line, "%.ppt%") OR like(process_cmd_line, "%.xls%") OR like(process_cmd_line,
-  "%.doc%") OR like(process_cmd_line, "%-nobanner%") OR like(process_cmd_line, "%/accepteula%")
-  OR like(process_cmd_line, "%-z %") OR like(process_cmd_line, "%-s %") OR like(process_cmd_line,
-  "%-q %") OR like(process_cmd_line, "%-r %") OR like(process_cmd_line, "%-p %") OR
-  like(process_cmd_line, "%-f %") OR like(process_cmd_line, "%-c %")) AND like(process_file_name,
-  "%sdelete%") 
+  actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
+  "map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
+  "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
+  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
+  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
+  any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
+  "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
+  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
+  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
+  null) | where (like(process_cmd_line, "%.xls%") OR like(process_cmd_line, "%.gz%")
+  OR like(process_cmd_line, "%.tar%") OR like(process_cmd_line, "%.rar%") OR like(process_cmd_line,
+  "%.zip%") OR like(process_cmd_line, "%.7z%") OR like(process_cmd_line, "%.bmp%")
+  OR like(process_cmd_line, "%.gif%") OR like(process_cmd_line, "%.png%") OR like(process_cmd_line,
+  "%.jpg%") OR like(process_cmd_line, "%.txt%") OR like(process_cmd_line, "%.log%")
+  OR like(process_cmd_line, "%.key%") OR like(process_cmd_line, "%.pdf%") OR like(process_cmd_line,
+  "%.rtf%") OR like(process_cmd_line, "%.ppt%") OR like(process_cmd_line, "%.xls%")
+  OR like(process_cmd_line, "%.doc%") OR like(process_cmd_line, "%-nobanner%") OR
+  like(process_cmd_line, "%/accepteula%") OR like(process_cmd_line, "%-z %") OR like(process_cmd_line,
+  "%-s %") OR like(process_cmd_line, "%-q %") OR like(process_cmd_line, "%-r %") OR
+  like(process_cmd_line, "%-p %") OR like(process_cmd_line, "%-f %") OR like(process_cmd_line,
+  "%-c %")) AND like(process_file_name, "%sdelete%") 
   | eval body=create_map(
     "devices", [
         create_map(
@@ -42,11 +42,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
         )
     ],
     "time", timestamp,
-    "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line),
-    "message", concat("Sdelete Application Execution has been triggered on ", device_hostname, " by ", process_user_name, "."),
+    "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
+    "message", concat("Sdelete Application Execution has been triggered on ", device_hostname, " by ", actor_user_name, "."),
     "users", [
         create_map(
-            "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null)
+            "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
         )
     ],
     "activity_id", 1,
@@ -73,10 +73,15 @@ references:
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1485/T1485.md
 tags:
   required_fields:
-  - process.user.name
-  - device.hostname
+  - process.pid
+  - process.file.path
   - process.file.name
   - process.cmd_line
+  - actor.user.name
+  - actor.process.pid
+  - actor.process.file.path
+  - actor.process.file.name
+  - device.hostname
   risk_score: 42
   security_domain: endpoint
   risk_severity: low
@@ -91,7 +96,7 @@ tags:
     cim: process_name
   - ocsf: process.cmd_line
     cim: process
-  - ocsf: process.user.name
+  - ocsf: actor.user.name
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id

dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml

@@ -1,11 +1,11 @@
 name: System Process Running from Unexpected Location
 id: 28179107-099a-464a-94d3-08301e6c055f
-version: 5
-description: An attacker might try to use a different version of a system command
-  without overriding the original, or they might try to avoid some detections by running
-  the process from a different folder. This detection checks that a list of system
-  processes are run inside C:\\Windows\System32 or C:\\Windows\SysWOW64. The list
-  of system processes has been extracted from https://github.com/splunk/security_content/blob/develop/lookups/is_windows_system_file.csv
+version: 4
+description: An attacker tries might try to use different version of a system command
+  without overriding original, or they might try to avoid some detection running the
+  process from a different folder. This detection checks that a list of system processes
+  run inside C:\\Windows\System32 or C:\\Windows\SysWOW64 The list of system processes
+  has been extracted from https://github.com/splunk/security_content/blob/develop/lookups/is_windows_system_file.csv
   and the original detection https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml
 search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
   null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
@@ -15,64 +15,64 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
   null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
   | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
-  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
-  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
-  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
-  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
-  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
-  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
-  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
-  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
-  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  (process_file_name="xwizard.exe" OR process_file_name="xpsrchvw.exe" OR process_file_name="xcopy.exe"
-  OR process_file_name="wusa.exe" OR process_file_name="wuauclt.exe" OR process_file_name="wuapp.exe"
-  OR process_file_name="wuapihost.exe" OR process_file_name="wsqmcons.exe" OR process_file_name="wsmprovhost.exe"
-  OR process_file_name="wscript.exe" OR process_file_name="write.exe" OR process_file_name="wpr.exe"
-  OR process_file_name="wpnpinst.exe" OR process_file_name="wowreg32.exe" OR process_file_name="wlrmdr.exe"
-  OR process_file_name="wlanext.exe" OR process_file_name="wksprt.exe" OR process_file_name="wkspbroker.exe"
-  OR process_file_name="wisptis.exe" OR process_file_name="winver.exe" OR process_file_name="winrshost.exe"
-  OR process_file_name="winrs.exe" OR process_file_name="winresume.exe" OR process_file_name="winlogon.exe"
-  OR process_file_name="winload.exe" OR process_file_name="wininit.exe" OR process_file_name="wimserv.exe"
-  OR process_file_name="wifitask.exe" OR process_file_name="wiawow64.exe" OR process_file_name="wiaacmgr.exe"
-  OR process_file_name="whoami.exe" OR process_file_name="where.exe" OR process_file_name="wextract.exe"
-  OR process_file_name="wevtutil.exe" OR process_file_name="wermgr.exe" OR process_file_name="wecutil.exe"
-  OR process_file_name="wbengine.exe" OR process_file_name="wbadmin.exe" OR process_file_name="waitfor.exe"
-  OR process_file_name="w32tm.exe" OR process_file_name="vssadmin.exe" OR process_file_name="vmicsvc.exe"
-  OR process_file_name="verifiergui.exe" OR process_file_name="verifier.exe" OR process_file_name="verclsid.exe"
-  OR process_file_name="vdsldr.exe" OR process_file_name="vds.exe" OR process_file_name="userinit.exe"
-  OR process_file_name="upnpcont.exe" OR process_file_name="unregmp2.exe" OR process_file_name="unlodctr.exe"
-  OR process_file_name="ucsvc.exe" OR process_file_name="tzutil.exe" OR process_file_name="tzsync.exe"
-  OR process_file_name="typeperf.exe" OR process_file_name="tskill.exe" OR process_file_name="tsdiscon.exe"
-  OR process_file_name="tscon.exe" OR process_file_name="tracerpt.exe" OR process_file_name="tpmvscmgrsvr.exe"
-  OR process_file_name="tpmvscmgr.exe" OR process_file_name="timeout.exe" OR process_file_name="tcmsetup.exe"
-  OR process_file_name="taskmgr.exe" OR process_file_name="tasklist.exe" OR process_file_name="taskkill.exe"
-  OR process_file_name="taskhostw.exe" OR process_file_name="taskhost.exe" OR process_file_name="taskeng.exe"
-  OR process_file_name="takeown.exe" OR process_file_name="tabcal.exe" OR process_file_name="systray.exe"
-  OR process_file_name="systemreset.exe" OR process_file_name="systeminfo.exe" OR
-  process_file_name="syskey.exe" OR process_file_name="sxstrace.exe" OR process_file_name="svchost.exe"
-  OR process_file_name="subst.exe" OR process_file_name="srdelayed.exe" OR process_file_name="spreview.exe"
-  OR process_file_name="sppsvc.exe" OR process_file_name="spoolsv.exe" OR process_file_name="spinstall.exe"
-  OR process_file_name="sort.exe" OR process_file_name="snmptrap.exe" OR process_file_name="smss.exe"
-  OR process_file_name="slui.exe" OR process_file_name="sihost.exe" OR process_file_name="sigverif.exe"
-  OR process_file_name="shutdown.exe" OR process_file_name="shrpubw.exe" OR process_file_name="shadow.exe"
-  OR process_file_name="setx.exe" OR process_file_name="setupugc.exe" OR process_file_name="setupcl.exe"
-  OR process_file_name="setspn.exe" OR process_file_name="sethc.exe" OR process_file_name="sessionmsg.exe"
-  OR process_file_name="services.exe" OR process_file_name="secinit.exe" OR process_file_name="sdiagnhost.exe"
-  OR process_file_name="sdclt.exe" OR process_file_name="sdchange.exe" OR process_file_name="sdbinst.exe"
-  OR process_file_name="schtasks.exe" OR process_file_name="sc.exe" OR process_file_name="sbunattend.exe"
-  OR process_file_name="rwinsta.exe" OR process_file_name="runonce.exe" OR process_file_name="rundll32.exe"
-  OR process_file_name="runas.exe" OR process_file_name="rstrui.exe" OR process_file_name="rrinstaller.exe"
-  OR process_file_name="rmttpmvscmgrsvr.exe" OR process_file_name="resmon.exe" OR
-  process_file_name="reset.exe" OR process_file_name="replace.exe" OR process_file_name="repair-bde.exe"
-  OR process_file_name="relog.exe" OR process_file_name="rekeywiz.exe" OR process_file_name="regsvr32.exe"
-  OR process_file_name="regini.exe" OR process_file_name="regedt32.exe" OR process_file_name="reg.exe"
-  OR process_file_name="recover.exe" OR process_file_name="recdisc.exe" OR process_file_name="rdrleakdiag.exe"
-  OR process_file_name="rdpinput.exe" OR process_file_name="rdpclip.exe" OR process_file_name="rasphone.exe"
-  OR process_file_name="raserver.exe" OR process_file_name="rasdial.exe" OR process_file_name="rasautou.exe"
-  OR process_file_name="qwinsta.exe" OR process_file_name="quser.exe" OR process_file_name="query.exe"
-  OR process_file_name="qprocess.exe" OR process_file_name="qappsrv.exe" OR process_file_name="pwlauncher.exe"
-  OR process_file_name="psr.exe" OR process_file_name="provtool.exe" OR process_file_name="proquota.exe"
-  OR process_file_name="printui.exe" OR process_file_name="printfilterpipelinesvc.exe"
+  actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
+  "map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
+  "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
+  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
+  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
+  any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
+  "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
+  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
+  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
+  null) | where (process_file_name="xwizard.exe" OR process_file_name="xpsrchvw.exe"
+  OR process_file_name="xcopy.exe" OR process_file_name="wusa.exe" OR process_file_name="wuauclt.exe"
+  OR process_file_name="wuapp.exe" OR process_file_name="wuapihost.exe" OR process_file_name="wsqmcons.exe"
+  OR process_file_name="wsmprovhost.exe" OR process_file_name="wscript.exe" OR process_file_name="write.exe"
+  OR process_file_name="wpr.exe" OR process_file_name="wpnpinst.exe" OR process_file_name="wowreg32.exe"
+  OR process_file_name="wlrmdr.exe" OR process_file_name="wlanext.exe" OR process_file_name="wksprt.exe"
+  OR process_file_name="wkspbroker.exe" OR process_file_name="wisptis.exe" OR process_file_name="winver.exe"
+  OR process_file_name="winrshost.exe" OR process_file_name="winrs.exe" OR process_file_name="winresume.exe"
+  OR process_file_name="winlogon.exe" OR process_file_name="winload.exe" OR process_file_name="wininit.exe"
+  OR process_file_name="wimserv.exe" OR process_file_name="wifitask.exe" OR process_file_name="wiawow64.exe"
+  OR process_file_name="wiaacmgr.exe" OR process_file_name="whoami.exe" OR process_file_name="where.exe"
+  OR process_file_name="wextract.exe" OR process_file_name="wevtutil.exe" OR process_file_name="wermgr.exe"
+  OR process_file_name="wecutil.exe" OR process_file_name="wbengine.exe" OR process_file_name="wbadmin.exe"
+  OR process_file_name="waitfor.exe" OR process_file_name="w32tm.exe" OR process_file_name="vssadmin.exe"
+  OR process_file_name="vmicsvc.exe" OR process_file_name="verifiergui.exe" OR process_file_name="verifier.exe"
+  OR process_file_name="verclsid.exe" OR process_file_name="vdsldr.exe" OR process_file_name="vds.exe"
+  OR process_file_name="userinit.exe" OR process_file_name="upnpcont.exe" OR process_file_name="unregmp2.exe"
+  OR process_file_name="unlodctr.exe" OR process_file_name="ucsvc.exe" OR process_file_name="tzutil.exe"
+  OR process_file_name="tzsync.exe" OR process_file_name="typeperf.exe" OR process_file_name="tskill.exe"
+  OR process_file_name="tsdiscon.exe" OR process_file_name="tscon.exe" OR process_file_name="tracerpt.exe"
+  OR process_file_name="tpmvscmgrsvr.exe" OR process_file_name="tpmvscmgr.exe" OR
+  process_file_name="timeout.exe" OR process_file_name="tcmsetup.exe" OR process_file_name="taskmgr.exe"
+  OR process_file_name="tasklist.exe" OR process_file_name="taskkill.exe" OR process_file_name="taskhostw.exe"
+  OR process_file_name="taskhost.exe" OR process_file_name="taskeng.exe" OR process_file_name="takeown.exe"
+  OR process_file_name="tabcal.exe" OR process_file_name="systray.exe" OR process_file_name="systemreset.exe"
+  OR process_file_name="systeminfo.exe" OR process_file_name="syskey.exe" OR process_file_name="sxstrace.exe"
+  OR process_file_name="svchost.exe" OR process_file_name="subst.exe" OR process_file_name="srdelayed.exe"
+  OR process_file_name="spreview.exe" OR process_file_name="sppsvc.exe" OR process_file_name="spoolsv.exe"
+  OR process_file_name="spinstall.exe" OR process_file_name="sort.exe" OR process_file_name="snmptrap.exe"
+  OR process_file_name="smss.exe" OR process_file_name="slui.exe" OR process_file_name="sihost.exe"
+  OR process_file_name="sigverif.exe" OR process_file_name="shutdown.exe" OR process_file_name="shrpubw.exe"
+  OR process_file_name="shadow.exe" OR process_file_name="setx.exe" OR process_file_name="setupugc.exe"
+  OR process_file_name="setupcl.exe" OR process_file_name="setspn.exe" OR process_file_name="sethc.exe"
+  OR process_file_name="sessionmsg.exe" OR process_file_name="services.exe" OR process_file_name="secinit.exe"
+  OR process_file_name="sdiagnhost.exe" OR process_file_name="sdclt.exe" OR process_file_name="sdchange.exe"
+  OR process_file_name="sdbinst.exe" OR process_file_name="schtasks.exe" OR process_file_name="sc.exe"
+  OR process_file_name="sbunattend.exe" OR process_file_name="rwinsta.exe" OR process_file_name="runonce.exe"
+  OR process_file_name="rundll32.exe" OR process_file_name="runas.exe" OR process_file_name="rstrui.exe"
+  OR process_file_name="rrinstaller.exe" OR process_file_name="rmttpmvscmgrsvr.exe"
+  OR process_file_name="resmon.exe" OR process_file_name="reset.exe" OR process_file_name="replace.exe"
+  OR process_file_name="repair-bde.exe" OR process_file_name="relog.exe" OR process_file_name="rekeywiz.exe"
+  OR process_file_name="regsvr32.exe" OR process_file_name="regini.exe" OR process_file_name="regedt32.exe"
+  OR process_file_name="reg.exe" OR process_file_name="recover.exe" OR process_file_name="recdisc.exe"
+  OR process_file_name="rdrleakdiag.exe" OR process_file_name="rdpinput.exe" OR process_file_name="rdpclip.exe"
+  OR process_file_name="rasphone.exe" OR process_file_name="raserver.exe" OR process_file_name="rasdial.exe"
+  OR process_file_name="rasautou.exe" OR process_file_name="qwinsta.exe" OR process_file_name="quser.exe"
+  OR process_file_name="query.exe" OR process_file_name="qprocess.exe" OR process_file_name="qappsrv.exe"
+  OR process_file_name="pwlauncher.exe" OR process_file_name="psr.exe" OR process_file_name="provtool.exe"
+  OR process_file_name="proquota.exe" OR process_file_name="printui.exe" OR process_file_name="printfilterpipelinesvc.exe"
   OR process_file_name="print.exe" OR process_file_name="prevhost.exe" OR process_file_name="powercfg.exe"
   OR process_file_name="poqexec.exe" OR process_file_name="plasrv.exe" OR process_file_name="phoneactivate.exe"
   OR process_file_name="perfmon.exe" OR process_file_name="pcwrun.exe" OR process_file_name="pcawrk.exe"
@@ -243,11 +243,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
         )
     ],
     "time", timestamp,
-    "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line),
-    "message", concat("System Process Running from Unexpected Location has been triggered on ", device_hostname, " by ", process_user_name, "."),
+    "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
+    "message", concat("System Process Running from Unexpected Location has been triggered on ", device_hostname, " by ", actor_user_name, "."),
     "users", [
         create_map(
-            "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null)
+            "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
         )
     ],
     "activity_id", 1,
@@ -268,11 +268,15 @@ known_false_positives: None
 references: []
 tags:
   required_fields:
-  - process.user.name
-  - device.hostname
+  - process.pid
   - process.file.path
   - process.file.name
   - process.cmd_line
+  - actor.user.name
+  - actor.process.pid
+  - actor.process.file.path
+  - actor.process.file.name
+  - device.hostname
   risk_score: 56
   security_domain: endpoint
   risk_severity: medium
@@ -287,7 +291,7 @@ tags:
     cim: process_name
   - ocsf: process.cmd_line
     cim: process
-  - ocsf: process.user.name
+  - ocsf: actor.user.name
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id

dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml

@@ -12,16 +12,16 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
   null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
   | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
-  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
-  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
-  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
-  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
-  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
-  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
-  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
-  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
-  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  process_file_name="wbadmin.exe" AND (like(process_cmd_line, "%systemstatebackup%")
+  actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
+  "map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
+  "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
+  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
+  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
+  any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
+  "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
+  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
+  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
+  null) | where process_file_name="wbadmin.exe" AND (like(process_cmd_line, "%systemstatebackup%")
   OR like(process_cmd_line, "%catalog%") OR like(process_cmd_line, "%delete%")) 
   | eval body=create_map(
     "devices", [
@@ -30,11 +30,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
         )
     ],
     "time", timestamp,
-    "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line),
-    "message", concat("WBAdmin Delete System Backups has been triggered on ", device_hostname, " by ", process_user_name, "."),
+    "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
+    "message", concat("WBAdmin Delete System Backups has been triggered on ", device_hostname, " by ", actor_user_name, "."),
     "users", [
         create_map(
-            "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null)
+            "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
         )
     ],
     "activity_id", 1,
@@ -61,10 +61,15 @@ references:
 - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin
 tags:
   required_fields:
-  - process.user.name
-  - device.hostname
+  - process.pid
+  - process.file.path
   - process.file.name
   - process.cmd_line
+  - actor.user.name
+  - actor.process.pid
+  - actor.process.file.path
+  - actor.process.file.name
+  - device.hostname
   risk_score: 15
   security_domain: endpoint
   risk_severity: low
@@ -79,7 +84,7 @@ tags:
     cim: process_name
   - ocsf: process.cmd_line
     cim: process
-  - ocsf: process.user.name
+  - ocsf: actor.user.name
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id

dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml

@@ -12,16 +12,16 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
   null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
   | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
-  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
-  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
-  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
-  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
-  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
-  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
-  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
-  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
-  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  (match_regex(process_cmd_line, /(?i)powershell/)=true OR match_regex(process_cmd_line,
+  actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
+  "map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
+  "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
+  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
+  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
+  any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
+  "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
+  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
+  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
+  null) | where (match_regex(process_cmd_line, /(?i)powershell/)=true OR match_regex(process_cmd_line,
   /(?i)setup/)=true OR match_regex(process_cmd_line, /(?i)application/)=true OR match_regex(process_cmd_line,
   /(?i)sysmon/)=true OR match_regex(process_cmd_line, /(?i)system/)=true OR match_regex(process_cmd_line,
   /(?i)security/)=true) AND like(process_cmd_line, "% cl %") AND process_file_name="wevtutil.exe"
@@ -33,11 +33,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
         )
     ],
     "time", timestamp,
-    "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line),
-    "message", concat("WevtUtil Usage To Clear Logs has been triggered on ", device_hostname, " by ", process_user_name, "."),
+    "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
+    "message", concat("WevtUtil Usage To Clear Logs has been triggered on ", device_hostname, " by ", actor_user_name, "."),
     "users", [
         create_map(
-            "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null)
+            "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
         )
     ],
     "activity_id", 1,
@@ -64,10 +64,15 @@ references:
 - https://www.splunk.com/en_us/blog/security/detecting-clop-ransomware.html
 tags:
   required_fields:
-  - process.user.name
-  - device.hostname
+  - process.pid
+  - process.file.path
   - process.file.name
   - process.cmd_line
+  - actor.user.name
+  - actor.process.pid
+  - actor.process.file.path
+  - actor.process.file.name
+  - device.hostname
   risk_score: 63
   security_domain: endpoint
   risk_severity: medium
@@ -82,7 +87,7 @@ tags:
     cim: process_name
   - ocsf: process.cmd_line
     cim: process
-  - ocsf: process.user.name
+  - ocsf: actor.user.name
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id

dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml

@@ -12,17 +12,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
   null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
   | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
-  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
-  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
-  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
-  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
-  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
-  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
-  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
-  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
-  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  like(process_cmd_line, "%/e:false%") AND like(process_cmd_line, "% sl %") AND process_file_name="wevtutil.exe"
-  
+  actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
+  "map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
+  "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
+  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
+  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
+  any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
+  "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
+  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
+  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
+  null) | where like(process_cmd_line, "%/e:false%") AND like(process_cmd_line, "%
+  sl %") AND process_file_name="wevtutil.exe" 
   | eval body=create_map(
     "devices", [
         create_map(
@@ -30,11 +30,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
         )
     ],
     "time", timestamp,
-    "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line),
-    "message", concat("Wevtutil Usage To Disable Logs has been triggered on ", device_hostname, " by ", process_user_name, "."),
+    "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
+    "message", concat("Wevtutil Usage To Disable Logs has been triggered on ", device_hostname, " by ", actor_user_name, "."),
     "users", [
         create_map(
-            "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null)
+            "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
         )
     ],
     "activity_id", 1,
@@ -61,10 +61,15 @@ references:
 - https://www.bleepingcomputer.com/news/security/new-ransom-x-ransomware-used-in-texas-txdot-cyberattack/
 tags:
   required_fields:
-  - process.user.name
-  - device.hostname
+  - process.pid
+  - process.file.path
   - process.file.name
   - process.cmd_line
+  - actor.user.name
+  - actor.process.pid
+  - actor.process.file.path
+  - actor.process.file.name
+  - device.hostname
   risk_score: 63
   security_domain: endpoint
   risk_severity: medium
@@ -79,7 +84,7 @@ tags:
     cim: process_name
   - ocsf: process.cmd_line
     cim: process
-  - ocsf: process.user.name
+  - ocsf: actor.user.name
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id

dist/ssa/srs/ssa___windows_bits_job_persistence.yml

@@ -16,16 +16,16 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
   null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
   | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
-  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
-  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
-  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
-  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
-  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
-  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
-  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
-  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
-  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  (like(process_cmd_line, "%resume%") OR like(process_cmd_line, "%setcustomheaders%")
+  actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
+  "map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
+  "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
+  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
+  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
+  any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
+  "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
+  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
+  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
+  null) | where (like(process_cmd_line, "%resume%") OR like(process_cmd_line, "%setcustomheaders%")
   OR like(process_cmd_line, "%setminretrydelay%") OR like(process_cmd_line, "%setnotifycmdline%")
   OR like(process_cmd_line, "%setnotifyflags%") OR like(process_cmd_line, "%addfile%")
   OR like(process_cmd_line, "%create%")) AND process_file_name="bitsadmin.exe" 
@@ -36,11 +36,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
         )
     ],
     "time", timestamp,
-    "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line),
-    "message", concat("Windows Bits Job Persistence has been triggered on ", device_hostname, " by ", process_user_name, "."),
+    "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
+    "message", concat("Windows Bits Job Persistence has been triggered on ", device_hostname, " by ", actor_user_name, "."),
     "users", [
         create_map(
-            "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null)
+            "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
         )
     ],
     "activity_id", 1,
@@ -71,10 +71,15 @@ references:
 - https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/
 tags:
   required_fields:
-  - process.user.name
-  - device.hostname
+  - process.pid
+  - process.file.path
   - process.file.name
   - process.cmd_line
+  - actor.user.name
+  - actor.process.pid
+  - actor.process.file.path
+  - actor.process.file.name
+  - device.hostname
   risk_score: 56
   security_domain: endpoint
   risk_severity: medium
@@ -89,7 +94,7 @@ tags:
     cim: process_name
   - ocsf: process.cmd_line
     cim: process
-  - ocsf: process.user.name
+  - ocsf: actor.user.name
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id

dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml

@@ -21,16 +21,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
   null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
   | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
-  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
-  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
-  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
-  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
-  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
-  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
-  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
-  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
-  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  like(process_cmd_line, "%transfer%") AND process_file_name="bitsadmin.exe" 
+  actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
+  "map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
+  "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
+  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
+  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
+  any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
+  "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
+  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
+  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
+  null) | where like(process_cmd_line, "%transfer%") AND process_file_name="bitsadmin.exe"
+  
   | eval body=create_map(
     "devices", [
         create_map(
@@ -38,11 +39,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
         )
     ],
     "time", timestamp,
-    "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line),
-    "message", concat("Windows Bitsadmin Download File has been triggered on ", device_hostname, " by ", process_user_name, "."),
+    "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
+    "message", concat("Windows Bitsadmin Download File has been triggered on ", device_hostname, " by ", actor_user_name, "."),
     "users", [
         create_map(
-            "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null)
+            "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
         )
     ],
     "activity_id", 1,
@@ -72,10 +73,15 @@ references:
 - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/
 tags:
   required_fields:
-  - process.user.name
-  - device.hostname
+  - process.pid
+  - process.file.path
   - process.file.name
   - process.cmd_line
+  - actor.user.name
+  - actor.process.pid
+  - actor.process.file.path
+  - actor.process.file.name
+  - device.hostname
   risk_score: 49
   security_domain: endpoint
   risk_severity: low
@@ -90,7 +96,7 @@ tags:
     cim: process_name
   - ocsf: process.cmd_line
     cim: process
-  - ocsf: process.user.name
+  - ocsf: actor.user.name
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id