Branch was auto-updated.

.gitignore

@@ -114,3 +114,4 @@ venv.bak/
 package/bin/sftp-config.json
 package/default/sftp-config.json
 *.code-snippets
+notes

detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml

@@ -8,7 +8,6 @@ datamodel: []
 description: This detection indicates use of Mimikatz modules that facilitate Pass-the-Token
   attack, Golden or Silver kerberos ticket attack, and Skeleton key attack.
 search: '| from read_ssa_enriched_events()
-
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
   cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
   != null AND ( match_regex(cmd_line, /(?i)kerberos::ptt/)=true OR match_regex(cmd_line,
@@ -17,7 +16,7 @@ search: '| from read_ssa_enriched_events()
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body = "TBD" | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.

detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml

@@ -20,7 +20,7 @@ search: '| from read_ssa_enriched_events()
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body = "TBD" | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.

detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml

@@ -15,7 +15,7 @@ search: '| from read_ssa_enriched_events()
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body = "TBD" | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.

detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml

@@ -18,7 +18,7 @@ search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(ma
   OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\Security/)=true OR match_regex(cmd_line,
   /(?i)HKEY_LOCAL_MACHINE\\SAM/)=true OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\System/)=true
   ) | eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id,
-  dest_user_id), body = "TBD" | into write_ssa_detected_events(); '
+  dest_user_id), body=create_map(["cmd_line", cmd_line, "process_name", process_name]) | into write_ssa_detected_events(); '
 how_to_implement: You must be ingesting windows endpoint data that tracks process
   activity, including parent-child relationships from your endpoints.
 known_false_positives: None identified.

detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml

@@ -26,7 +26,7 @@ search: '| from read_ssa_enriched_events()
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body = "TBD" | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.

detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml

@@ -27,7 +27,7 @@ search: '| from read_ssa_enriched_events()
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body = "TBD" | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.

detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml

@@ -24,7 +24,7 @@ search: ' | from read_ssa_enriched_events()
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body = "TBD" | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.

detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml

@@ -22,7 +22,7 @@ search: ' | from read_ssa_enriched_events()
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body = "TBD" | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.

detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml

@@ -20,7 +20,7 @@ search: ' | from read_ssa_enriched_events()
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body = "TBD" | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.

detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml

@@ -18,7 +18,7 @@ search: ' | from read_ssa_enriched_events()
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body = "TBD" | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.

detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml

@@ -22,7 +22,7 @@ search: '| from read_ssa_enriched_events()
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body = "TBD" | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.

detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml

@@ -23,7 +23,7 @@ search: ' | from read_ssa_enriched_events()
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body = "TBD" | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: Although unlikely, using debuggers this way may be indicative

detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml

@@ -20,7 +20,7 @@ search: ' | from read_ssa_enriched_events()
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body = "TBD" | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: Although unlikely, using debuggers this way may be indicative

detections/endpoint/ssa___credential_extraction_powersploit_modules.yml

@@ -23,7 +23,7 @@ search: '| from read_ssa_enriched_events()
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body = "TBD" | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.

detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml

@@ -14,7 +14,7 @@ search: '| from read_ssa_enriched_events() | eval tenant=ucast(map_get(input_eve
   null)), process=lower(ucast(map_get(input_event, "process"), "string", null)) |
   where process_name LIKE "%rundll32.exe%" AND match_regex(process, /(?i)comsvcs.dll[,\s]+MiniDump/)=true
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend(machine),
-  body = "TBD" | into write_ssa_detected_events();'
+  body=create_map(["process_name", process_name]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting endpoint data that tracks process activity,
   including Windows command line logging. You can see how we test this with [Event
   Code 4688](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4688a)

detections/endpoint/ssa___detect_kerberoasting.yml

@@ -14,7 +14,7 @@ search: ' | from read_ssa_enriched_events() | eval _time=map_get(input_event, "_
   "service_id") | where EventCode="4769" AND TicketOptions="0x40810000" AND TicketEncryptionType="0x17"
   | first_time_event input_columns=["EventCode","TicketOptions","TicketEncryptionType","ServiceName","ServiceID"]
   | where first_time_EventCode_TicketOptions_TicketEncryptionType_ServiceName_ServiceID
-  | eval start_time=_time, end_time=_time, body="TBD", entities="TBD" | select start_time,
+  | eval start_time=_time, end_time=_time, body=create_map(["EventCode", EventCode, "ServiceName", ServiceName, "TicketOptions", TicketOptions, "TicketEncryptionType", TicketEncryptionType]), entities="TBD" | select start_time,
   end_time, entities, body | into write_null(); '
 how_to_implement: The test data is converted from Windows Security Event logs generated
   from Attach Range simulation and used in SPL search and extended to SPL2

detections/endpoint/ssa___detect_pass_hash.yml

@@ -20,7 +20,7 @@ search: ' | from read_ssa_enriched_events()
   AND authentication_method="seclogo")
 
   | eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id,
-  dest_user_id), body="TBD" | into write_ssa_detected_events();'
+  dest_user_id), body=create_map(["authentication_type", authentication_type, "authentication_method", authentication_method]) | into write_ssa_detected_events();'
 how_to_implement: The test data is converted from Windows Security Event logs generated
   from Attach Range simulation and used in SPL search and extended to SPL2
 known_false_positives: Legitimate logon activity by authorized NTLM systems may be

detections/endpoint/ssa___first_time_seen_cmd_line.yml

@@ -22,7 +22,7 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
   ""), /.* \/[cC] .*/)=true | select cmd_line, cmd_line_norm, timestamp, dest_device_id,
   dest_user_id | first_time_event input_columns=["cmd_line_norm"] | where first_time_cmd_line_norm
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id,
-  dest_user_id), body = "TBD" | into write_ssa_detected_events();'
+  dest_user_id), body=create_map(["cmd_line", cmd_line, "process_name", process_name]) | into write_ssa_detected_events();'
 how_to_implement: You must be populating the endpoint data model for SSA and specifically
   the process_name and the process fields
 known_false_positives: Legitimate programs can also use command-line arguments to

detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml

@@ -20,7 +20,7 @@ search: '| from read_ssa_enriched_events()
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body = "TBD" | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.

detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml

@@ -15,7 +15,7 @@ search: '| from read_ssa_enriched_events()
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body = "TBD" | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.

detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml

@@ -16,7 +16,7 @@ search: '| from read_ssa_enriched_events()
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body = "TBD" | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.

detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml

@@ -16,7 +16,7 @@ search: '| from read_ssa_enriched_events()
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body = "TBD" | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.

detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml

@@ -18,7 +18,7 @@ search: '| from read_ssa_enriched_events()
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body = "TBD" | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.

detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml

@@ -19,7 +19,7 @@ search: '| from read_ssa_enriched_events()
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body = "TBD" | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.

detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml

@@ -19,7 +19,7 @@ search: '| from read_ssa_enriched_events()
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body = "TBD" | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.

detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml

@@ -16,7 +16,7 @@ search: '| from read_ssa_enriched_events()
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body = "TBD" | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.

detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml

@@ -19,7 +19,7 @@ search: '| from read_ssa_enriched_events()
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body = "TBD" | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.

detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml

@@ -27,7 +27,7 @@ search: '| from read_ssa_enriched_events()
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body = "TBD" | into write_ssa_detected_events();'
+  "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.

detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml

@@ -17,7 +17,7 @@ search: '| from read_ssa_enriched_events()
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body = "TBD" | into write_ssa_detected_events();'
+  "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.

detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml

@@ -24,7 +24,7 @@ search: '| from read_ssa_enriched_events()
   OR field0="java.exe" OR field0="powershell.exe"
 
   | eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id,
-  dest_user_id), body="TBD" | into write_ssa_detected_events();'
+  dest_user_id), body=create_map([ "process_name", process_name, "parent_process_name", parent_process_name]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting sysmon logs. This search has been modified
   to process raw sysmon data from attack_range's nxlogs on DSP.
 known_false_positives: There are circumstances where an application may legitimately

detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml

@@ -28,7 +28,7 @@ search: '| from read_ssa_enriched_events()
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body = "TBD" | into write_ssa_detected_events();'
+  "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.

detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml

@@ -37,7 +37,7 @@ search: '| from read_ssa_enriched_events()
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body = "TBD" | into write_ssa_detected_events();'
+  "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.

detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml

@@ -16,7 +16,7 @@ search: '| from read_ssa_enriched_events()
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body = "TBD" | into write_ssa_detected_events();'
+  "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.

detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml

@@ -27,7 +27,7 @@ search: '| from read_ssa_enriched_events()
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body = "TBD" | into write_ssa_detected_events();'
+  "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.

detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml

@@ -20,7 +20,7 @@ search: '| from read_ssa_enriched_events()
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body = "TBD" | into write_ssa_detected_events();'
+  "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.

detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml

@@ -15,7 +15,7 @@ search: '| from read_ssa_enriched_events()
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body = "TBD" | into write_ssa_detected_events();'
+  "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.

detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml

@@ -22,7 +22,7 @@ search: '| from read_ssa_enriched_events()
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body = "TBD" | into write_ssa_detected_events();'
+  "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.

detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml

@@ -15,7 +15,7 @@ search: '| from read_ssa_enriched_events()
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body = "TBD" | into write_ssa_detected_events();'
+  "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.

detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml

@@ -20,7 +20,7 @@ search: '| from read_ssa_enriched_events()
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body = "TBD" | into write_ssa_detected_events();'
+  "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.

detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml

@@ -21,7 +21,7 @@ search: '| from read_ssa_enriched_events()
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body = "TBD" | into write_ssa_detected_events();'
+  "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.

detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml

@@ -18,7 +18,7 @@ search: '| from read_ssa_enriched_events()
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body = "TBD" | into write_ssa_detected_events();'
+  "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.

detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml

@@ -15,7 +15,7 @@ search: '| from read_ssa_enriched_events()
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body = "TBD" | into write_ssa_detected_events();'
+  "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.

detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml

@@ -15,7 +15,7 @@ search: '| from read_ssa_enriched_events()
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body = "TBD" | into write_ssa_detected_events();'
+  "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.

detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml

@@ -19,7 +19,7 @@ search: '| from read_ssa_enriched_events()
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body = "TBD" | into write_ssa_detected_events();'
+  "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.

detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml

@@ -16,7 +16,7 @@ search: '| from read_ssa_enriched_events()
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body = "TBD" | into write_ssa_detected_events();'
+  "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.

detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml

@@ -21,7 +21,7 @@ search: '| from read_ssa_enriched_events()
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body = "TBD" | into write_ssa_detected_events();'
+  "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.

detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml

@@ -16,7 +16,7 @@ search: '| from read_ssa_enriched_events()
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body = "TBD" | into write_ssa_detected_events();'
+  "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.

detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml

@@ -15,7 +15,7 @@ search: '| from read_ssa_enriched_events()
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body = "TBD" | into write_ssa_detected_events();'
+  "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.

detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml

@@ -40,7 +40,7 @@ search: ' | from read_ssa_enriched_events() | eval device=ucast(map_get(input_ev
   device,span(timestamp, 300s) | eval lolbas_counter=lolbas_counter*1.0 | rename window_end
   as timestamp | adaptive_threshold algorithm="quantile" value="lolbas_counter" entity="device"
   window=2419200000L | where label AND quantile>0.99 | eval start_time = window_start,
-  end_time = timestamp, entities = mvappend(device), body = "TBD" | into write_null();'
+  end_time = timestamp, entities = mvappend(device), body=create_map(["process_name", process_name]) | into write_null();'
 how_to_implement: Collect endpoint data such as sysmon or 4688 events.
 known_false_positives: 'Some administrative tasks may involve multiple use of LOLBAS
   applications in a short period of time. This might trigger false positives at the

detections/endpoint/ssa___unusually_long_command_line.yml

@@ -21,8 +21,7 @@ search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(ma
   input | adaptive_threshold algorithm="quantile" entity="process_name" window=60480000
   | where label AND quantile>0.99 | first_time_event input_columns=["dest_device_id",
   "cmd_line"] | where first_time_dest_device_id_cmd_line | eval start_time = timestamp,
-  end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body =
-  "TBD" | into write_ssa_detected_events();'
+  end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body=create_map(["cmd_line", cmd_line, "process_name", process_name]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting sysmon endpoint data that monitors command
   lines.
 known_false_positives: This detection may flag suspiciously long command lines when