adding 4 detections from validation to production mode

dev_ssa/endpoint/ssa___impacket_lateral_movement_smbexec_commandline_parameters.yml

@@ -1,9 +1,9 @@
 name: Impacket Lateral Movement smbexec CommandLine Parameters
-id: bc7d91c3-8693-4899-808b-1bfc88d58cfa
+id: c1238942-2715-41ee-b371-0475da48029c
 version: 1
 date: '2024-01-01'
 author: Michael Haag, Splunk
-status: validation
+status: production
 type: TTP
 data_source:
 - Windows Security 4688

dev_ssa/endpoint/ssa___impacket_lateral_movement_wmiexec_commandline_parameters.yml

@@ -1,9 +1,9 @@
 name: Impacket Lateral Movement WMIExec Commandline Parameters
-id: d99fb1c3-9934-4fb8-9d00-ab82fc2a01ee
+id: 9d07ff50-e968-456e-a3d9-c65c38ed0ab0
 version: 1
 date: '2024-02-01'
 author: Michael Haag, Splunk
-status: validation
+status: production
 type: TTP
 data_source:
 - Windows Security 4688

dev_ssa/endpoint/ssa___serviceprincipalnames_discovery_with_powershell.yml

@@ -1,9 +1,9 @@
 name: ServicePrincipalNames Discovery with PowerShell
-id: 54d7a7b1-c60f-431e-992d-b61382ab6b64
+id: 043f07a0-7fd8-40e2-b526-80406fb59abb
 version: 2
 date: '2024-02-01'
 author: Michael Haag, Splunk
-status: validation
+status: production
 type: TTP
 description: 'The following analytic identifies `powershell.exe` usage, using Script
   Block Logging EventCode 4104, related to querying the domain for Service Principle

dev_ssa/endpoint/ssa___windows_screen_capture_via_powershell.yml

@@ -1,9 +1,9 @@
 name: Windows Screen Capture Via Powershell
-id: 3b49e58f-04c9-416b-96c9-016ac64e7e5f
+id: 678ae7c6-0e63-44db-9881-03202c312f66
 version: 1
 date: '2024-02-01'
 author: Teoderick Contreras, Splunk
-status: validation
+status: production
 type: TTP
 data_source:
 - Powershell 4104

ssa_detections/endpoint/ssa___impacket_lateral_movement_smbexec_commandline_parameters.yml

@@ -1,10 +1,10 @@
 name: Impacket Lateral Movement smbexec CommandLine Parameters
-id: bc7d91c3-8693-4899-808b-1bfc88d58cfa
+id: c1238942-2715-41ee-b371-0475da48029c
 version: 1
 date: '2024-01-01'
 author: Michael Haag, Splunk
 type: TTP
-status: validation
+status: production
 description: This analytic focuses on identifying suspicious command-line parameters
   commonly associated with the use of Impacket wmiexec.py. Impacket is a set of Python
   classes designed for working with Microsoft network protocols, and it includes several

ssa_detections/endpoint/ssa___impacket_lateral_movement_wmiexec_commandline_parameters.yml

@@ -1,10 +1,10 @@
 name: Impacket Lateral Movement WMIExec Commandline Parameters
-id: d99fb1c3-9934-4fb8-9d00-ab82fc2a01ee
+id: 9d07ff50-e968-456e-a3d9-c65c38ed0ab0
 version: 1
 date: '2024-02-01'
 author: Michael Haag, Splunk
 type: TTP
-status: validation
+status: production
 description: This analytic looks for the presence of suspicious commandline parameters
   typically present when using Impacket tools. Impacket is a collection of python
   classes meant to be used with Microsoft network protocols. There are multiple scripts

ssa_detections/endpoint/ssa___serviceprincipalnames_discovery_with_powershell.yml

@@ -1,10 +1,10 @@
 name: ServicePrincipalNames Discovery with PowerShell
-id: 54d7a7b1-c60f-431e-992d-b61382ab6b64
+id: 043f07a0-7fd8-40e2-b526-80406fb59abb
 version: 2
 date: '2024-02-01'
 author: Michael Haag, Splunk
 type: TTP
-status: validation
+status: production
 description: 'The following analytic identifies `powershell.exe` usage, using Script
   Block Logging EventCode 4104, related to querying the domain for Service Principle
   Names. typically, this is a precursor activity related to kerberoasting or the silver

ssa_detections/endpoint/ssa___windows_screen_capture_via_powershell.yml

@@ -1,10 +1,10 @@
 name: Windows Screen Capture Via Powershell
-id: 3b49e58f-04c9-416b-96c9-016ac64e7e5f
+id: 678ae7c6-0e63-44db-9881-03202c312f66
 version: 1
 date: '2024-02-01'
 author: Teoderick Contreras, Splunk
 type: TTP
-status: validation
+status: production
 description: The following analytic identifies a potential PowerShell script that
   captures screen images on compromised or targeted hosts. This technique was observed
   in the Winter-Vivern malware, which attempts to capture desktop screens using a