updating detections version

detections/endpoint/detect_rclone_command_line_usage.yml

@@ -1,7 +1,7 @@
 name: Detect RClone Command-Line Usage
 id: 32e0baea-b3f1-11eb-a2ce-acde48001122
-version: '8'
-date: '2025-03-03'
+version: '9'
+date: '2025-03-27'
 author: Michael Haag, Splunk
 status: production
 type: TTP

detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml

@@ -1,6 +1,6 @@
 name: Malicious PowerShell Process - Execution Policy Bypass
 id: 9be56c82-b1cc-4318-87eb-d138afaaca39
-version: '11'
+version: '12'
 date: '2025-02-24'
 author: Rico Valdez, Mauricio Velazco, Splunk
 status: production

detections/endpoint/remote_process_instantiation_via_wmi.yml

@@ -1,8 +1,8 @@
 name: Remote Process Instantiation via WMI
 id: d25d2c3d-d9d8-40ec-8fdf-e86fe155a3da
-version: '12'
-date: '2025-02-24'
-author: Rico Valdez, Mauricio Velazco, Splunk
+version: '13'
+date: '2025-03-27'
+author: Mauricio Velazco, Splunk
 status: production
 type: TTP
 description: The following analytic detects the execution of wmic.exe with parameters

detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml

@@ -1,6 +1,6 @@
 name: Remote Process Instantiation via WMI and PowerShell
 id: 112638b4-4634-11ec-b9ab-3e22fbd008af
-version: 13
+version: 15
 date: '2025-03-27'
 author: Mauricio Velazco, Splunk
 status: production

detections/endpoint/spoolsv_writing_a_dll___sysmon.yml

@@ -1,8 +1,8 @@
 name: Spoolsv Writing a DLL - Sysmon
 id: 347fd388-da87-11eb-836d-acde48001122
-version: '6'
-date: '2025-03-03'
-author: Mauricio Velazco, Michael Haag, Splunk
+version: '7'
+date: '2025-03-27'
+author: Mauricio Velazco, Splunk
 status: production
 type: TTP
 description: The following analytic detects `spoolsv.exe` writing a `.dll` file, which

detections/endpoint/windows_svchost_exe_parent_process_anomaly.yml

@@ -1,6 +1,6 @@
 name: Windows Svchost.exe Parent Process Anomaly
 id: 1d38e5e9-2ff8-4c47-872c-bf1657cefab5
-version: 1
+version: 2
 date: '2025-02-11'
 author: Teoderick Contreras, Splunk
 status: production

detections/endpoint/windows_unsigned_dll_side_loading.yml

@@ -1,6 +1,6 @@
 name: Windows Unsigned DLL Side-Loading
 id: 5a83ce44-8e0f-4786-a775-8249a525c879
-version: '8'
+version: '9'
 date: '2025-02-24'
 author: Teoderick Contreras, Splunk
 status: production

detections/endpoint/windows_unsigned_dll_side_loading_in_same_process_path.yml

@@ -1,6 +1,6 @@
 name: Windows Unsigned DLL Side-Loading In Same Process Path
 id: 3cf85c02-f9d6-4186-bf3c-e70ee99fbc7f
-version: 8
+version: 9
 date: '2025-02-26'
 author: Teoderick Contreras, Splunk
 data_source:

detections/endpoint/windows_unsigned_ms_dll_side_loading.yml

@@ -1,6 +1,6 @@
 name: Windows Unsigned MS DLL Side-Loading
 id: 8d9e0e06-ba71-4dc5-be16-c1a46d58728c
-version: '8'
+version: '9'
 date: '2025-02-24'
 author: Teoderick Contreras, Splunk
 data_source: