diff --git a/detections/endpoint/ssa___office_product_spawning_windows_script_host.yml b/detections/endpoint/ssa___office_product_spawning_windows_script_host.yml
new file mode 100644
index 0000000000..10382c2285
--- /dev/null
+++ b/detections/endpoint/ssa___office_product_spawning_windows_script_host.yml
@@ -0,0 +1,82 @@
+name: Office Product Spawning Windows Script Host
+id: 3ea3851a-8736-41a0-bc09-7e4485b48fa6
+version: 1
+date: '2022-10-12'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: The following analytic will identify a Windows Office Product spawning WScript.exe or CScript.exe. Tuning may be required based on legitimate application usage that may spawn scripts from an Office product.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=lower(ucast(map_get(input_event, "parent_process_name"), "string",
+  null)), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND parent_process_name IS NOT
+  NULL | where (like(parent_process_name, "%\\\\winword.exe") OR like(parent_process_name, "%\\\\excel.exe") OR like(parent_process_name, "%\\\\powerpnt.exe") OR like(parent_process_name, "%\\\\mspub.exe") OR like(parent_process_name, "%\\\\visio.exe")) AND (process_name="wscript.exe" OR
+  process_name="cscript.exe")
+  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name, "parent_process_name", parent_process_name, "process_path", process_path])
+  | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: False positives may be present based on macro based approved documents in the organization. Filtering may be needed.
+references:
+  - https://blog.cluster25.duskrise.com/2022/09/23/in-the-footsteps-of-the-fancy-bear-powerpoint-graphite/
+tags:
+  analytic_story:
+  - Spearphishing Attachments
+  cis20:
+  - CIS 8
+  confidence: 90
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.002/atomic_red_team/windows-security.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: A Microsoft office parent process $parent_process_name$ has spawned a suspicious child
+    process $process_name$ on host $dest$.
+  mitre_attack_id:
+  - T1566
+  - T1566.001
+  nist:
+  - PR.PT
+  - DE.CM
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  risk_score: 63
+  security_domain: endpoint
+  asset_type: Endpoint
diff --git a/detections/endpoint/ssa___windows_com_hijacking_inprocserver32_modification.yml b/detections/endpoint/ssa___windows_com_hijacking_inprocserver32_modification.yml
new file mode 100644
index 0000000000..e2fcacbd6d
--- /dev/null
+++ b/detections/endpoint/ssa___windows_com_hijacking_inprocserver32_modification.yml
@@ -0,0 +1,85 @@
+name: Windows COM Hijacking InprocServer32 Modification
+id: 0ae05a0f-bc84-456b-822a-a5b9c081c7ca
+version: 1
+date: '2022-10-12'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: The following analytic identifies the use of reg.exe performing an add to the InProcServer32, which may be related to COM hijacking.
+  Adversaries can use the COM system to insert malicious code that can be executed in place of legitimate software through hijacking the COM references and relationships as a means for persistence. Hijacking a COM object requires a change in the Registry to replace a reference to a legitimate system component which may cause that component to not work when executed. When that system component is executed through normal system operation the adversary's code will be executed instead.
+search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)), process_name=ucast(map_get(input_event,
+  "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
+  "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="reg.exe"
+  AND like (cmd_line, "%inprocserver32%") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)) | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line,
+  "process_name", process_name, "parent_process_name", parent_process_name, "process_path",
+  process_path]) | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: False positives may be present and some filtering may be required.
+references:
+  - https://attack.mitre.org/techniques/T1546/015/
+  - https://blog.cluster25.duskrise.com/2022/09/23/in-the-footsteps-of-the-fancy-bear-powerpoint-graphite/
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.015/T1546.015.md
+tags:
+  analytic_story:
+  - Living Off The Land
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.015/atomic_red_team/windows-security.log
+  impact: 80
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ has spawned $process_name$ attempting to modify InProcServer32 within the registry on $dest_device_id$ by $dest_user_id$.
+  mitre_attack_id:
+  - T1546.015
+  - T1546
+  nist:
+  - DE.CM
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  risk_severity: 'medium'
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 64
+  security_domain: endpoint
diff --git a/detections/endpoint/ssa___windows_exchange_powershell_module_usage.yml b/detections/endpoint/ssa___windows_exchange_powershell_module_usage.yml
new file mode 100644
index 0000000000..198092fb25
--- /dev/null
+++ b/detections/endpoint/ssa___windows_exchange_powershell_module_usage.yml
@@ -0,0 +1,96 @@
+name: Windows Exchange PowerShell Module Usage
+id: 1118bc65-b0c7-4589-bc2f-ad6802fd0909
+version: 1
+date: '2022-10-12'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: 'The following analytic identifies the usage of Exchange PowerShell modules
+  that were recently used for a proof of concept related to ProxyShell. Currently,
+  there is no active data shared or data we could re-produce relate to this part of
+  the ProxyShell chain of exploits.  \
+
+  Inherently, the usage of the modules is not malicious, but reviewing parallel processes,
+  and user, of the session will assist with determining the intent. \
+
+  Module - New-MailboxExportRequest will begin the process of exporting contents of
+  a primary mailbox or archive to a .pst file. \
+
+  Module - New-managementroleassignment can assign a management role to a management
+  role group, management role assignment policy, user, or universal security group
+  (USG). \
+  
+  Module - New-MailboxSearch cmdlet to create a mailbox search and either get an estimate of search results, place search results on In-Place Hold or copy them to a Discovery mailbox. You can also place all contents in a mailbox on hold by not specifying a search query, which accomplishes similar results as Litigation Hold. \
+  Module - Get-Recipient cmdlet to view existing recipient objects in your organization. This cmdlet returns all mail-enabled objects (for example, mailboxes, mail users, mail contacts, and distribution groups).'
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL | where
+  (like (cmd_line, "%new-mailboxexportrequest%") OR like (cmd_line, "%new-managementroleassignment%") OR like (cmd_line,
+  "%new-mailboxsearch%") OR like (cmd_line,"%get-recipient%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name, "parent_process_name", parent_process_name, "process_path", process_path])
+  | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this analytic, you will need to enable
+  PowerShell Script Block Logging on some or all endpoints. Additional setup here
+  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. This will only work with Multiline event logs, not XML.
+known_false_positives: Administrators or power users may use this PowerShell commandlet
+references:
+  - https://docs.microsoft.com/en-us/powershell/module/exchange/new-mailboxexportrequest?view=exchange-ps
+  - https://docs.microsoft.com/en-us/powershell/module/exchange/new-managementroleassignment?view=exchange-ps
+  - https://blog.orange.tw/2021/08/proxyshell-a-new-attack-surface-on-ms-exchange-part-3.html
+  - https://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell
+  - https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/
+  - https://www.cisa.gov/uscert/ncas/alerts/aa22-264a
+  - https://learn.microsoft.com/en-us/powershell/module/exchange/new-mailboxsearch?view=exchange-ps
+  - https://learn.microsoft.com/en-us/powershell/module/exchange/get-recipient?view=exchange-ps
+  - https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell/
+tags:
+  analytic_story:
+  - ProxyShell
+  - CISA AA22-264A
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  - Stage:Recon
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/exchange/windows-powershell.log
+  impact: 40
+  kill_chain_phases:
+  - Actions on Objectives
+  message:  Exchange enumeration using PowerShell on $dest_device_id$.
+  mitre_attack_id:
+  - T1059
+  - T1059.001
+  nist:
+  - DE.CM
+  observable:
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  risk_severity: 'medium'
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 32
+  security_domain: endpoint
diff --git a/tests/endpoint/ssa___office_product_spawning_windows_script_host.test.yml b/tests/endpoint/ssa___office_product_spawning_windows_script_host.test.yml
new file mode 100644
index 0000000000..893982f7b2
--- /dev/null
+++ b/tests/endpoint/ssa___office_product_spawning_windows_script_host.test.yml
@@ -0,0 +1,10 @@
+name: Office Product Spawning Windows Script Host Unit Test
+tests:
+- name: Office Product Spawning Windows Script Host
+  file: endpoint/ssa___office_product_spawning_windows_script_host.yml
+  pass_condition: '@count_gt(0)'
+  attack_data:
+  - file_name: windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.002/atomic_red_team/windows-security.log
+    source: XmlWinEventLog
+    update_timestamp: true
\ No newline at end of file
diff --git a/tests/endpoint/ssa___windows_com_hijacking_inprocserver32_modification.test.yml b/tests/endpoint/ssa___windows_com_hijacking_inprocserver32_modification.test.yml
new file mode 100644
index 0000000000..f37284998d
--- /dev/null
+++ b/tests/endpoint/ssa___windows_com_hijacking_inprocserver32_modification.test.yml
@@ -0,0 +1,13 @@
+name: Windows COM Hijacking InprocServer32 Modification Unit Test
+tests:
+- name: Windows COM Hijacking InprocServer32 Modification
+  file: endpoint/ssa___windows_com_hijacking_inprocserver32_modification.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.015/atomic_red_team/windows-security.log
+    source: XmlWinEventLog
+    sourcetype: XmlWinEventLog
+    update_timestamp: true
diff --git a/tests/endpoint/ssa___windows_exchange_powershell_module_usage.test.yml b/tests/endpoint/ssa___windows_exchange_powershell_module_usage.test.yml
new file mode 100644
index 0000000000..be7661b6a4
--- /dev/null
+++ b/tests/endpoint/ssa___windows_exchange_powershell_module_usage.test.yml
@@ -0,0 +1,13 @@
+name: Windows Exchange PowerShell Module Usage Unit Test
+tests:
+- name: Windows Exchange PowerShell Module Usage
+  file: endpoint/ssa___windows_exchange_powershell_module_usage.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: pwsh_multipass.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/pwsh_multipass.log
+    source: WinEventLog
+    sourcetype: WinEventLog
+    update_timestamp: true
\ No newline at end of file