From 3dfd3c6ed68c8d32d31c3549235b0fb62eaa66a3 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Thu, 28 Jul 2022 17:17:21 -0700
Subject: [PATCH 01/10] Updated search strings from "lockout" to "*locked out*"
 to reflect the string that actually appears in the logs.  Also, removed the
 nodename from the seach since it was not required.

---
 .../detect_excessive_account_lockouts_from_endpoint.yml       | 4 ++--
 .../endpoint/detect_excessive_user_account_lockouts.yml       | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml b/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml
index d9c4aa587a..961f552da7 100644
--- a/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml
+++ b/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml
@@ -10,8 +10,8 @@ description: This search identifies endpoints that have caused a relatively high
   of account lockouts in a short period.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime values(All_Changes.user) as user from datamodel=Change.All_Changes where
-  nodename=All_Changes.Account_Management All_Changes.result="lockout" by All_Changes.dest
-  All_Changes.result |`drop_dm_object_name("All_Changes")` |`drop_dm_object_name("Account_Management")`|
+  All_Changes.result="*locked out*" by All_Changes.dest All_Changes.result 
+  |`drop_dm_object_name("All_Changes")` |`drop_dm_object_name("Account_Management")`|
   `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | search
   count > 5 | `detect_excessive_account_lockouts_from_endpoint_filter`'
 how_to_implement: "You must ingest your Windows security event logs in the `Change`\
diff --git a/detections/endpoint/detect_excessive_user_account_lockouts.yml b/detections/endpoint/detect_excessive_user_account_lockouts.yml
index 2f6f1cbfc6..8edeccc228 100644
--- a/detections/endpoint/detect_excessive_user_account_lockouts.yml
+++ b/detections/endpoint/detect_excessive_user_account_lockouts.yml
@@ -9,8 +9,8 @@ datamodel:
 description: This search detects user accounts that have been locked out a relatively
   high number of times in a short period.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Change.All_Changes where nodename=All_Changes.Account_Management
-  All_Changes.result="lockout" by All_Changes.user All_Changes.result |`drop_dm_object_name("All_Changes")`
+  as lastTime from datamodel=Change.All_Changes where  All_Changes.result="*locked out*" 
+  by All_Changes.user All_Changes.result |`drop_dm_object_name("All_Changes")`
   |`drop_dm_object_name("Account_Management")`| `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | search count > 5 | `detect_excessive_user_account_lockouts_filter`'
 how_to_implement: ou must ingest your Windows security event logs in the `Change`

From 07d72ad1423feef60abe688db9664a7f4039e5d6 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Fri, 29 Jul 2022 14:22:50 -0700
Subject: [PATCH 02/10] Fixed a number of detections around anomalous aws
 console logins from different areas.  These include city, country, and
 region. They are all built around the same template and could still use some
 discussion.

---
 ...ws_console_login_by_user_from_new_city.yml | 26 ++++++++++++-------
 ...console_login_by_user_from_new_country.yml | 25 +++++++++++-------
 ..._console_login_by_user_from_new_region.yml | 26 ++++++++++++-------
 3 files changed, 48 insertions(+), 29 deletions(-)

diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml
index d68d521be8..c9a0099e57 100644
--- a/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml
+++ b/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml
@@ -11,16 +11,22 @@ description: This search looks for AWS CloudTrail events wherein a console login
   file of previously seen users (by ARN values) who have logged into the console.
   The alert is fired if the user has logged into the console for the first time within
   the last hour
-search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication
-  where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src
-  | iplocation Authentication.src | `drop_dm_object_name(Authentication)` | table
-  firstTime lastTime user City | join user  type=outer [| inputlookup previously_seen_users_console_logins
-  | stats min(firstTime) AS earliestseen by user City | fields earliestseen user City]
-  | eval userCity=if(firstTime >= relative_time(now(), "-24h@h"), "New City","Previously
-  Seen City") | eval userStatus=if(earliestseen >= relative_time(now(), "-24h@h")
-  OR isnull(earliestseen), "New User","Old User") | where userCity = "New City" AND
-  userStatus != "Old User" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | table firstTime lastTime user City  userStatus userCity  | `detect_aws_console_login_by_user_from_new_city_filter`'
+search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src 
+  | iplocation Authentication.src 
+  | `drop_dm_object_name(Authentication)` 
+  | rename City as justSeenCity 
+  | table firstTime lastTime user justSeenCity 
+  | join user type=outer 
+  [| inputlookup previously_seen_users_console_logins 
+  | rename City as previouslySeenCity 
+  | stats min(firstTime) AS earliestseen by user previouslySeenCity 
+  | fields earliestseen user previouslySeenCity] 
+  | eval userCity=if(firstTime >= relative_time(now(), "-24h@h"), "New City","Previously Seen City") 
+  | where userCity = "New City" 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | table firstTime lastTime user previouslySeenCity justSeenCity userCity 
+  | `detect_aws_console_login_by_user_from_new_city_filter`'
 how_to_implement: You must install and configure the Splunk Add-on for AWS (version
   5.1.0 or later) and Enterprise Security 6.2, which contains the required updates
   to the Authentication data model for cloud use cases. Run the `Previously Seen Users
diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml
index 73c4248d4d..f7dbaadd9a 100644
--- a/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml
+++ b/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml
@@ -12,15 +12,22 @@ description: This search looks for AWS CloudTrail events wherein a console login
   The alert is fired if the user has logged into the console for the first time within
   the last hour
 search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication
-  where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src
-  | iplocation Authentication.src | `drop_dm_object_name(Authentication)` | table
-  firstTime lastTime user Country | join user  type=outer [| inputlookup previously_seen_users_console_logins
-  | stats min(firstTime) AS earliestseen by user Country | fields earliestseen user
-  Country] | eval userCountry=if(firstTime >= relative_time(now(), "-24h@h"), "New
-  Country","Previously Seen Country") | eval userStatus=if(earliestseen >= relative_time(now(),"-24h@h")
-  OR isnull(earliestseen), "New User","Old User") | where userCountry = "New Country"
-  AND userStatus != "Old User" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | table firstTime lastTime user Country  userStatus userCountry  | `detect_aws_console_login_by_user_from_new_country_filter`'
+  where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src 
+  | iplocation Authentication.src 
+  | `drop_dm_object_name(Authentication)` 
+  | rename Country as justSeenCountry
+  | table firstTime lastTime user justSeenCountry 
+  | join user type=outer 
+  [| inputlookup previously_seen_users_console_logins
+  | rename Country as previouslySeenCountry
+  | stats min(firstTime) AS earliestseen by user previouslySeenCountry 
+  | fields earliestseen user previouslySeenCountry] 
+  | eval userCountry=if(firstTime >= relative_time(now(), "-24h@h"), "New Country","Previously Seen Country")
+  | where userCountry = "New Country"
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | table firstTime lastTime user previouslySeenCountry justSeenCountry userCountry 
+  | `detect_aws_console_login_by_user_from_new_country_filter`'
 how_to_implement: You must install and configure the Splunk Add-on for AWS (version
   5.1.0 or later) and Enterprise Security 6.2, which contains the required updates
   to the Authentication data model for cloud use cases. Run the `Previously Seen Users
diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml
index 0e046801ac..bd501b40cd 100644
--- a/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml
+++ b/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml
@@ -11,16 +11,22 @@ description: This search looks for AWS CloudTrail events wherein a console login
   file of previously seen users (by ARN values) who have logged into the console.
   The alert is fired if the user has logged into the console for the first time within
   the last hour
-search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication
-  where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src
-  | iplocation Authentication.src | `drop_dm_object_name(Authentication)` | table
-  firstTime lastTime user Region | join user  type=outer [| inputlookup previously_seen_users_console_logins
-  | stats min(firstTime) AS earliestseen by user Region | fields earliestseen user
-  Region] | eval userRegion=if(firstTime >= relative_time(now(), "-24h@h"), "New Region","Previously
-  Seen Region") | eval userStatus=if(earliestseen >= relative_time(now(), "-24h@h")
-  OR isnull(earliestseen), "New User","Old User") | where userRegion = "New Region"
-  AND userStatus != "Old User" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | table firstTime lastTime user Region  userStatus userRegion  | `detect_aws_console_login_by_user_from_new_region_filter`'
+search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src 
+  | iplocation Authentication.src 
+  | `drop_dm_object_name(Authentication)` 
+  | rename Region as justSeenRegion 
+  | table firstTime lastTime user justSeenRegion 
+  | join user type=outer 
+  [| inputlookup previously_seen_users_console_logins 
+  | rename Region as previouslySeenRegion 
+  | stats min(firstTime) AS earliestseen by user previouslySeenRegion 
+  | fields earliestseen user previouslySeenRegion] 
+  | eval userRegion=if(firstTime >= relative_time(now(), "-24h@h"), "New Region","Previously Seen Region") 
+  | where userRegion= "New Region" 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | table firstTime lastTime user previouslySeenRegion justSeenRegion userRegion 
+  | `detect_aws_console_login_by_user_from_new_region_filter`'
 how_to_implement: You must install and configure the Splunk Add-on for AWS (version
   5.1.0 or later) and Enterprise Security 6.2, which contains the required updates
   to the Authentication data model for cloud use cases. Run the `Previously Seen Users

From aafee44783b2806f0ef7dbce7be37dfb003410df Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Fri, 29 Jul 2022 14:23:49 -0700
Subject: [PATCH 03/10] Temporary fix to outstanding, known issue with field
 naming

---
 detections/endpoint/mshtml_module_load_in_office_product.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/mshtml_module_load_in_office_product.yml b/detections/endpoint/mshtml_module_load_in_office_product.yml
index 10ec4eb2d1..5cb397de90 100644
--- a/detections/endpoint/mshtml_module_load_in_office_product.yml
+++ b/detections/endpoint/mshtml_module_load_in_office_product.yml
@@ -11,7 +11,7 @@ description: The following detection identifies the module load of mshtml.dll in
   malicious document will load ActiveX, which activates the MSHTML component. The
   vulnerability resides in the MSHTML component. During triage, identify parallel
   processes and capture any file modifications for analysis.
-search: '`sysmon` EventID=7  process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe")
+search: '`sysmon` EventID=7  parent_process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe")
   ImageLoaded IN ("*\\mshtml.dll", "*\\Microsoft.mshtml.dll","*\\IE.Interop.MSHTML.dll","*\\MshtmlDac.dll","*\\MshtmlDed.dll","*\\MshtmlDer.dll")
   | stats count min(_time) as firstTime max(_time) as lastTime by Computer, process_name,
   ImageLoaded, OriginalFileName, ProcessGuid | rename Computer as dest | `security_content_ctime(firstTime)`

From 08107a940e484c8fb0b7386f9f0376044280ea04 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Sun, 31 Jul 2022 15:09:35 -0700
Subject: [PATCH 04/10] Quoted strings in severity field.  Fixed typo in
 severity field list from UNKNWON to UNKOWN.  Removed the non-existent stats
 field 'user' (username exists) which was causing the test to fail, returning
 no results.

---
 ..._container_scanning_findings_low_informational_unknown.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml b/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml
index 9345c11f36..b0ff90b1b0 100644
--- a/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml
+++ b/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml
@@ -10,12 +10,12 @@ description: This search looks for AWS CloudTrail events from AWS Elastic Contai
   with the results.
 search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings
   | spath path=responseElements.imageScanFindings.findings{} output=findings | mvexpand
-  findings | spath input=findings| search severity IN (LOW, INFORMATIONAL, UNKNWON)
+  findings | spath input=findings| search severity IN ("LOW", "INFORMATIONAL", "UNKNOWN")
   | rename name as finding_name, description as finding_description, requestParameters.imageId.imageDigest
   as imageDigest, requestParameters.repositoryName as repositoryName | eval finding
   = finding_name.", ".finding_description | eval phase="release" | eval severity="low"
   | stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName,
-  eventSource, imageDigest, repositoryName, user, userName, src_ip, finding, phase,
+  eventSource, imageDigest, repositoryName, userName, src_ip, finding, phase,
   severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `aws_ecr_container_scanning_findings_low_informational_unknown_filter`'
 how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This

From e2c3c7590d929f891417396af85ba0496162291a Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Sun, 31 Jul 2022 15:25:56 -0700
Subject: [PATCH 05/10] Changed process_name to parent_process_name Known issue
 pending a fix.

---
 .../powershell_remote_thread_to_known_windows_process.yml       | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml b/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml
index 55fb743ab0..dd1ec5c1a4 100644
--- a/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml
+++ b/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml
@@ -11,7 +11,7 @@ description: this search is designed to detect suspicious powershell process tha
   CreateRemoteThread. This technique is seen in several malware like trickbot and
   offensive tooling like cobaltstrike where it load a shellcode to svchost.exe to
   execute reverse shell to c2 and download another payload
-search: '`sysmon` EventCode = 8 process_name IN ("powershell_ise.exe", "powershell.exe")
+search: '`sysmon` EventCode = 8 parent_process_name IN ("powershell_ise.exe", "powershell.exe")
   TargetImage IN ("*\\svchost.exe","*\\csrss.exe" "*\\gpupdate.exe", "*\\explorer.exe","*\\services.exe","*\\winlogon.exe","*\\smss.exe","*\\wininit.exe","*\\userinit.exe","*\\spoolsv.exe","*\\taskhost.exe")
   | stats  min(_time) as firstTime max(_time) as lastTime count by SourceImage process_name
   SourceProcessId SourceProcessGuid TargetImage TargetProcessId NewThreadId StartAddress

From cdbdc510334fdc2da440716468343519400d7620 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Sun, 31 Jul 2022 16:47:59 -0700
Subject: [PATCH 06/10] Patched for a known outstanding issue - process_name to
 parent_process_name

---
 detections/endpoint/windows_installutil_credential_theft.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/windows_installutil_credential_theft.yml b/detections/endpoint/windows_installutil_credential_theft.yml
index d0c6050e63..8964e70cfb 100644
--- a/detections/endpoint/windows_installutil_credential_theft.yml
+++ b/detections/endpoint/windows_installutil_credential_theft.yml
@@ -21,9 +21,9 @@ description: 'The following analytic identifies the Windows InstallUtil.exe bina
 
   During triage review resulting network connections, file modifications, and parallel
   processes. Capture any artifacts and review further.'
-search: '`sysmon` EventCode=7  process_name=installutil.exe ImageLoaded IN ("*\\samlib.dll",
+search: '`sysmon` EventCode=7  parent_process_name=installutil.exe ImageLoaded IN ("*\\samlib.dll",
   "*\\vaultcli.dll") | stats count min(_time) as firstTime max(_time) as lastTime
-  by Computer, process_name, ImageLoaded, OriginalFileName, ProcessId | rename Computer
+  by Computer, parent_process_name, ImageLoaded, OriginalFileName, ProcessId | rename Computer
   as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `windows_installutil_credential_theft_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting

From 1b3707932b804fda948261bf1b846e9646ea35fa Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Sun, 31 Jul 2022 16:49:35 -0700
Subject: [PATCH 07/10] Fixed known outstanding issue with process_name and
 parent_process_name

---
 .../endpoint/office_document_creating_schedule_task.yml       | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/office_document_creating_schedule_task.yml b/detections/endpoint/office_document_creating_schedule_task.yml
index 13636ffc50..7dac9b5768 100644
--- a/detections/endpoint/office_document_creating_schedule_task.yml
+++ b/detections/endpoint/office_document_creating_schedule_task.yml
@@ -19,9 +19,9 @@ description: this search detects a potential malicious office document that crea
   source. Was it schtasks.exe or via TaskService? Review the job created and the Command
   to be executed. Capture any artifacts on disk and review. Identify any parallel
   processes within the same timeframe to identify source.'
-search: '`sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE")
+search: '`sysmon` EventCode=7 parent_process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE")
   ImageLoaded = "*\\taskschd.dll" | stats min(_time) as firstTime max(_time) as lastTime
-  values(ImageLoaded) as AllImageLoaded count by Computer EventCode Image process_name
+  values(ImageLoaded) as AllImageLoaded count by Computer EventCode Image parent_process_name
   ProcessId ProcessGuid | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `office_document_creating_schedule_task_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting

From e7102508d94fef37766028cf9967d215f3a58296 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Fri, 19 Aug 2022 15:05:40 -0700
Subject: [PATCH 08/10] Removed with: develop from the detection- testing
 workflows since we need to test a new version of the detection testing code.

---
 .github/workflows/detection-testing.yml | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/detection-testing.yml b/.github/workflows/detection-testing.yml
index a2bba1b154..0bd7a20c76 100644
--- a/.github/workflows/detection-testing.yml
+++ b/.github/workflows/detection-testing.yml
@@ -50,8 +50,8 @@ jobs:
 
         - name: Checkout Repo
           uses: actions/checkout@v2
-          with:
-            ref: develop
+          #with:
+          #  ref: develop
         
       
 
@@ -139,8 +139,8 @@ jobs:
 
         - name: Checkout Repo
           uses: actions/checkout@v2
-          with:
-            ref: develop
+          #with:
+          #  ref: develop
         
         - name: Download artifacts
           uses: actions/download-artifact@v2
@@ -198,8 +198,8 @@ jobs:
 
         - name: Checkout Repo
           uses: actions/checkout@v2
-          with:
-            ref: develop
+          #with:
+          #  ref: develop
         
         - name: Download artifacts
           uses: actions/download-artifact@v2

From 8b47ea7b36c61f46317863a4c4d47a12757d13ad Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Thu, 25 Aug 2022 15:08:46 -0700
Subject: [PATCH 09/10] Updating the author(s), versions, and dates for
 searches in PR.

---
 ..._container_scanning_findings_low_informational_unknown.yml | 4 ++--
 .../detect_excessive_account_lockouts_from_endpoint.yml       | 4 ++--
 .../endpoint/detect_excessive_user_account_lockouts.yml       | 4 ++--
 detections/endpoint/mshtml_module_load_in_office_product.yml  | 4 ++--
 .../endpoint/office_document_creating_schedule_task.yml       | 4 ++--
 .../powershell_remote_thread_to_known_windows_process.yml     | 4 ++--
 detections/endpoint/windows_installutil_credential_theft.yml  | 4 ++--
 7 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml b/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml
index b0ff90b1b0..4052cac446 100644
--- a/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml
+++ b/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml
@@ -1,8 +1,8 @@
 name: AWS ECR Container Scanning Findings Low Informational Unknown
 id: cbc95e44-7c22-443f-88fd-0424478f5589
 version: 1
-date: '2021-08-17'
-author: Patrick Bareiss, Splunk
+date: '2022-08-25'
+author: Patrick Bareiss, Eric McGinnis Splunk
 type: Hunting
 datamodel: []
 description: This search looks for AWS CloudTrail events from AWS Elastic Container
diff --git a/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml b/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml
index 961f552da7..5469f9c712 100644
--- a/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml
+++ b/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml
@@ -1,7 +1,7 @@
 name: Detect Excessive Account Lockouts From Endpoint
 id: c026e3dd-7e18-4abb-8f41-929e836efe74
-version: 5
-date: '2020-11-09'
+version: 6
+date: '2022-08-25'
 author: David Dorsey, Splunk
 type: Anomaly
 datamodel:
diff --git a/detections/endpoint/detect_excessive_user_account_lockouts.yml b/detections/endpoint/detect_excessive_user_account_lockouts.yml
index 8edeccc228..50e2d877ae 100644
--- a/detections/endpoint/detect_excessive_user_account_lockouts.yml
+++ b/detections/endpoint/detect_excessive_user_account_lockouts.yml
@@ -1,7 +1,7 @@
 name: Detect Excessive User Account Lockouts
 id: 95a7f9a5-6096-437e-a19e-86f42ac609bd
-version: 3
-date: '2020-07-21'
+version: 4
+date: '2022-08-25'
 author: David Dorsey, Splunk
 type: Anomaly
 datamodel:
diff --git a/detections/endpoint/mshtml_module_load_in_office_product.yml b/detections/endpoint/mshtml_module_load_in_office_product.yml
index 5cb397de90..803050cfe7 100644
--- a/detections/endpoint/mshtml_module_load_in_office_product.yml
+++ b/detections/endpoint/mshtml_module_load_in_office_product.yml
@@ -1,7 +1,7 @@
 name: MSHTML Module Load in Office Product
 id: 5f1c168e-118b-11ec-84ff-acde48001122
-version: 2
-date: '2022-06-01'
+version: 3
+date: '2022-08-25'
 author: Michael Haag, Mauricio Velazco, Splunk
 type: TTP
 datamodel:
diff --git a/detections/endpoint/office_document_creating_schedule_task.yml b/detections/endpoint/office_document_creating_schedule_task.yml
index 7dac9b5768..4e50acae24 100644
--- a/detections/endpoint/office_document_creating_schedule_task.yml
+++ b/detections/endpoint/office_document_creating_schedule_task.yml
@@ -1,7 +1,7 @@
 name: Office Document Creating Schedule Task
 id: cc8b7b74-9d0f-11eb-8342-acde48001122
-version: 1
-date: '2021-04-14'
+version: 2
+date: '2022-08-25'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
diff --git a/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml b/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml
index dd1ec5c1a4..d7483dca48 100644
--- a/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml
+++ b/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml
@@ -1,7 +1,7 @@
 name: Powershell Remote Thread To Known Windows Process
 id: ec102cb2-a0f5-11eb-9b38-acde48001122
-version: 1
-date: '2021-04-19'
+version: 2
+date: '2022-08-25'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
diff --git a/detections/endpoint/windows_installutil_credential_theft.yml b/detections/endpoint/windows_installutil_credential_theft.yml
index 8964e70cfb..dd113911d4 100644
--- a/detections/endpoint/windows_installutil_credential_theft.yml
+++ b/detections/endpoint/windows_installutil_credential_theft.yml
@@ -1,7 +1,7 @@
 name: Windows InstallUtil Credential Theft
 id: ccfeddec-43ec-11ec-b494-acde48001122
-version: 2
-date: '2022-06-01'
+version: 3
+date: '2022-08-25'
 author: Michael Haag, Mauricio Velazo, Splunk
 type: TTP
 datamodel:

From 474ea412918cbf41e1d1dcab75498244d789a87a Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Thu, 25 Aug 2022 15:09:13 -0700
Subject: [PATCH 10/10] Finishing updates authors, versions, and dates on
 searches.

---
 .../detect_aws_console_login_by_user_from_new_city.yml      | 6 +++---
 .../detect_aws_console_login_by_user_from_new_country.yml   | 6 +++---
 .../detect_aws_console_login_by_user_from_new_region.yml    | 6 +++---
 3 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml
index d21afa8b12..e1f112c9d6 100644
--- a/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml
+++ b/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml
@@ -1,8 +1,8 @@
 name: Detect AWS Console Login by User from New City
 id: 121b0b11-f8ac-4ed6-a132-3800ca4fc07a
-version: 1
-date: '2020-10-07'
-author: Bhavin Patel, Splunk
+version: 2
+date: '2022-08-25'
+author: Bhavin Patel, Eric McGinnis Splunk
 type: Hunting
 datamodel:
 - Authentication
diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml
index 123bb749c0..2f1fe53c8a 100644
--- a/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml
+++ b/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml
@@ -1,8 +1,8 @@
 name: Detect AWS Console Login by User from New Country
 id: 67bd3def-c41c-4bf6-837b-ae196b4257c6
-version: 1
-date: '2020-10-07'
-author: Bhavin Patel, Splunk
+version: 2
+date: '2022-08-25'
+author: Bhavin Patel, Eric McGinnis Splunk
 type: Hunting
 datamodel:
 - Authentication
diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml
index a83216b03d..f6ac8156d4 100644
--- a/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml
+++ b/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml
@@ -1,8 +1,8 @@
 name: Detect AWS Console Login by User from New Region
 id: 9f31aa8e-e37c-46bc-bce1-8b3be646d026
-version: 1
-date: '2020-10-07'
-author: Bhavin Patel, Splunk
+version: 2
+date: '2022-08-25'
+author: Bhavin Patel, Eric McGinnis Splunk
 type: Hunting
 datamodel:
 - Authentication