From d0ac4416261ea1738aad26dbaf84def1d1ee77a6 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 1 Nov 2022 23:01:16 +0000
Subject: [PATCH 1/7] Bump psutil from 5.9.2 to 5.9.3

Bumps [psutil](https://github.com/giampaolo/psutil) from 5.9.2 to 5.9.3.
- [Release notes](https://github.com/giampaolo/psutil/releases)
- [Changelog](https://github.com/giampaolo/psutil/blob/master/HISTORY.rst)
- [Commits](https://github.com/giampaolo/psutil/compare/release-5.9.2...release-5.9.3)

---
updated-dependencies:
- dependency-name: psutil
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 requirements.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/requirements.txt b/requirements.txt
index 65f121dc86..8c86625d48 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -4,7 +4,7 @@ GitPython==3.1.27
 Jinja2==3.1.2
 jsonschema==4.16.0
 mock==4.0.3
-psutil==5.9.2
+psutil==5.9.3
 pycvesearch==1.2
 pydantic==1.10.2
 pytest==7.1.3

From d14c840ada94a9fe58fddb3667d405539278ae44 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 1 Nov 2022 23:01:20 +0000
Subject: [PATCH 2/7] Bump pytest from 7.1.3 to 7.2.0

Bumps [pytest](https://github.com/pytest-dev/pytest) from 7.1.3 to 7.2.0.
- [Release notes](https://github.com/pytest-dev/pytest/releases)
- [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst)
- [Commits](https://github.com/pytest-dev/pytest/compare/7.1.3...7.2.0)

---
updated-dependencies:
- dependency-name: pytest
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 requirements.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/requirements.txt b/requirements.txt
index 65f121dc86..64b209d59f 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -7,7 +7,7 @@ mock==4.0.3
 psutil==5.9.2
 pycvesearch==1.2
 pydantic==1.10.2
-pytest==7.1.3
+pytest==7.2.0
 PyYAML==5.4.1
 questionary==1.10.0
 requests==2.28.1

From 05cbbbcf723ee841997cb59c5061be0fee427668 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 1 Nov 2022 23:01:26 +0000
Subject: [PATCH 3/7] Bump gitpython from 3.1.27 to 3.1.29

Bumps [gitpython](https://github.com/gitpython-developers/GitPython) from 3.1.27 to 3.1.29.
- [Release notes](https://github.com/gitpython-developers/GitPython/releases)
- [Changelog](https://github.com/gitpython-developers/GitPython/blob/main/CHANGES)
- [Commits](https://github.com/gitpython-developers/GitPython/compare/3.1.27...3.1.29)

---
updated-dependencies:
- dependency-name: gitpython
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 requirements.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/requirements.txt b/requirements.txt
index 65f121dc86..51433fbf2c 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,6 +1,6 @@
 attackcti==0.3.7
 docker==6.0.0
-GitPython==3.1.27
+GitPython==3.1.29
 Jinja2==3.1.2
 jsonschema==4.16.0
 mock==4.0.3

From b0ad14b44acec0ef5e0802a2c1ed18b1e1afb995 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 1 Nov 2022 23:01:28 +0000
Subject: [PATCH 4/7] Bump jsonschema from 4.16.0 to 4.17.0

Bumps [jsonschema](https://github.com/python-jsonschema/jsonschema) from 4.16.0 to 4.17.0.
- [Release notes](https://github.com/python-jsonschema/jsonschema/releases)
- [Changelog](https://github.com/python-jsonschema/jsonschema/blob/main/CHANGELOG.rst)
- [Commits](https://github.com/python-jsonschema/jsonschema/compare/v4.16.0...v4.17.0)

---
updated-dependencies:
- dependency-name: jsonschema
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 requirements.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/requirements.txt b/requirements.txt
index 65f121dc86..fa4185ceb1 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -2,7 +2,7 @@ attackcti==0.3.7
 docker==6.0.0
 GitPython==3.1.27
 Jinja2==3.1.2
-jsonschema==4.16.0
+jsonschema==4.17.0
 mock==4.0.3
 psutil==5.9.2
 pycvesearch==1.2

From 0f5893bd27ae26d92b9d57e487ff49856c483b57 Mon Sep 17 00:00:00 2001
From: mvelazco <mauricio.velazco@gmail.com>
Date: Fri, 4 Nov 2022 12:50:51 -0400
Subject: [PATCH 5/7] updating mitre ids

---
 .../cloud/aws_console_login_failed_during_mfa_challenge.yml | 3 +++
 detections/cloud/aws_credential_access_failed_login.yml     | 3 +++
 detections/cloud/aws_credential_access_getpassworddata.yml  | 5 ++++-
 .../cloud/aws_credential_access_rds_password_reset.yml      | 4 +++-
 .../cloud/aws_multi_factor_authentication_disabled.yml      | 4 ++++
 .../cloud/aws_multiple_failed_mfa_requests_for_user.yml     | 2 ++
 .../aws_multiple_users_failing_to_authenticate_from_ip.yml  | 4 +++-
 .../cloud/aws_successful_single_factor_authentication.yml   | 3 +++
 ...aws_unusual_number_of_failed_authentications_from_ip.yml | 6 +++++-
 .../cloud/azure_active_directory_high_risk_sign_in.yml      | 2 ++
 .../azure_ad_authentication_failed_during_mfa_challenge.yml | 2 ++
 .../cloud/azure_ad_multi_factor_authentication_disabled.yml | 3 +++
 .../azure_ad_multiple_failed_mfa_requests_for_user.yml      | 2 ++
 ...re_ad_multiple_users_failing_to_authenticate_from_ip.yml | 2 ++
 .../cloud/azure_ad_successful_powershell_authentication.yml | 2 ++
 .../azure_ad_successful_single_factor_authentication.yml    | 2 ++
 ..._ad_unusual_number_of_failed_authentications_from_ip.yml | 3 +++
 detections/cloud/detect_aws_console_login_by_new_user.yml   | 2 ++
 .../detect_aws_console_login_by_user_from_new_city.yml      | 2 ++
 .../detect_aws_console_login_by_user_from_new_country.yml   | 2 ++
 .../detect_aws_console_login_by_user_from_new_region.yml    | 2 ++
 .../gcp_authentication_failed_during_mfa_challenge.yml      | 2 ++
 .../cloud/gcp_multi_factor_authentication_disabled.yml      | 2 ++
 .../cloud/gcp_multiple_failed_mfa_requests_for_user.yml     | 2 ++
 .../gcp_multiple_users_failing_to_authenticate_from_ip.yml  | 4 ++++
 .../cloud/gcp_successful_single_factor_authentication.yml   | 2 ++
 ...gcp_unusual_number_of_failed_authentications_from_ip.yml | 4 ++++
 detections/endpoint/rubeus_command_line_parameters.yml      | 2 +-
 28 files changed, 73 insertions(+), 5 deletions(-)

diff --git a/detections/cloud/aws_console_login_failed_during_mfa_challenge.yml b/detections/cloud/aws_console_login_failed_during_mfa_challenge.yml
index b40a10abcb..38b241aff2 100644
--- a/detections/cloud/aws_console_login_failed_during_mfa_challenge.yml
+++ b/detections/cloud/aws_console_login_failed_during_mfa_challenge.yml
@@ -36,7 +36,10 @@ tags:
   - Exploitation
   message: User $user_name$ failed to pass MFA challenge while logging into console from $src$
   mitre_attack_id:
+  - T1586
+  - T1586.003
   - T1621
+
   nist:
   - DE.CM
   observable:
diff --git a/detections/cloud/aws_credential_access_failed_login.yml b/detections/cloud/aws_credential_access_failed_login.yml
index f3ba0c78a0..c4a686e34b 100644
--- a/detections/cloud/aws_credential_access_failed_login.yml
+++ b/detections/cloud/aws_credential_access_failed_login.yml
@@ -31,6 +31,9 @@ tags:
   - Exploitation
   message: User $user$ has a login failure from IP $src$
   mitre_attack_id:
+  - T1586
+  - T1586.003
+  - T1110
   - T1110.001
   nist:
   - DE.CM
diff --git a/detections/cloud/aws_credential_access_getpassworddata.yml b/detections/cloud/aws_credential_access_getpassworddata.yml
index 4985d40b74..15eb0c7492 100644
--- a/detections/cloud/aws_credential_access_getpassworddata.yml
+++ b/detections/cloud/aws_credential_access_getpassworddata.yml
@@ -31,7 +31,10 @@ tags:
   - Exploitation
   message: User $user_arn$ is seen to make mulitple `GetPasswordData` API calls to instance ids $instance_ids$ from IP $src_ip$
   mitre_attack_id:
-  - T1552
+  - T1586
+  - T1586.003
+  - T1110
+  - T1110.001
   nist:
   - DE.CM
   observable:
diff --git a/detections/cloud/aws_credential_access_rds_password_reset.yml b/detections/cloud/aws_credential_access_rds_password_reset.yml
index 0ba6b0bf6c..ae4a03dc77 100644
--- a/detections/cloud/aws_credential_access_rds_password_reset.yml
+++ b/detections/cloud/aws_credential_access_rds_password_reset.yml
@@ -33,7 +33,9 @@ tags:
   - Exploitation
   message: $DB$ password has been reset from IP $sourceIPAddress$
   mitre_attack_id:
-  - T1110.002
+  - T1586
+  - T1586.003
+  - T1110
   nist:
   - DE.CM
   observable:
diff --git a/detections/cloud/aws_multi_factor_authentication_disabled.yml b/detections/cloud/aws_multi_factor_authentication_disabled.yml
index 3172088b23..2206732243 100644
--- a/detections/cloud/aws_multi_factor_authentication_disabled.yml
+++ b/detections/cloud/aws_multi_factor_authentication_disabled.yml
@@ -37,7 +37,11 @@ tags:
   - Exploitation
   message: User $user_name$ has disabled Multi-Factor authentication for AWS account $aws_account_id$
   mitre_attack_id:
+  - T1586
+  - T1586.003
   - T1621
+  - T1556
+  - T1556.006
   nist:
   - DE.CM
   observable:
diff --git a/detections/cloud/aws_multiple_failed_mfa_requests_for_user.yml b/detections/cloud/aws_multiple_failed_mfa_requests_for_user.yml
index e05445d491..9abe1fb688 100644
--- a/detections/cloud/aws_multiple_failed_mfa_requests_for_user.yml
+++ b/detections/cloud/aws_multiple_failed_mfa_requests_for_user.yml
@@ -34,6 +34,8 @@ tags:
   - Exploitation
   message: User $user_name$ is seen to have high number of MFA prompt failures within a short period of time.
   mitre_attack_id:
+  - T1586
+  - T1586.003
   - T1621
   nist:
   - DE.CM
diff --git a/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml b/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml
index 1ff5d539f2..bc190d62c8 100644
--- a/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml
+++ b/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml
@@ -35,7 +35,9 @@ tags:
   - Exploitation
   message: Multiple failed console login attempts against users $tried_accounts$ seen from $src_ip$
   mitre_attack_id:
-  - T1003.002
+  - T1110
+  - T1110.003
+  - T1110.004
   nist:
   - DE.CM
   observable:
diff --git a/detections/cloud/aws_successful_single_factor_authentication.yml b/detections/cloud/aws_successful_single_factor_authentication.yml
index f63618d4c2..1212d5b92e 100644
--- a/detections/cloud/aws_successful_single_factor_authentication.yml
+++ b/detections/cloud/aws_successful_single_factor_authentication.yml
@@ -33,6 +33,9 @@ tags:
   - Exploitation
   message: User $user_name$ has successfully logged into an AWS Console without Multi-Factor Authentication from $src$
   mitre_attack_id:
+  - T1586
+  - T1586.003
+  - T1078
   - T1078.004
   nist:
   - DE.CM
diff --git a/detections/cloud/aws_unusual_number_of_failed_authentications_from_ip.yml b/detections/cloud/aws_unusual_number_of_failed_authentications_from_ip.yml
index b035216410..fac4dec9f0 100644
--- a/detections/cloud/aws_unusual_number_of_failed_authentications_from_ip.yml
+++ b/detections/cloud/aws_unusual_number_of_failed_authentications_from_ip.yml
@@ -39,7 +39,11 @@ tags:
   - Exploitation
   message: Unusual number of failed console login attempts against users $tried_accounts$ seen from $src_ip$
   mitre_attack_id:
-  - T1003.002
+  - T1586
+  - T1586.003
+  - T1110
+  - T1110.003
+  - T1110.004
   nist:
   - DE.CM
   observable:
diff --git a/detections/cloud/azure_active_directory_high_risk_sign_in.yml b/detections/cloud/azure_active_directory_high_risk_sign_in.yml
index b31b4d3f11..2245e98e13 100644
--- a/detections/cloud/azure_active_directory_high_risk_sign_in.yml
+++ b/detections/cloud/azure_active_directory_high_risk_sign_in.yml
@@ -38,6 +38,8 @@ tags:
   - Exploitation
   message: A high risk event was identified by Identify Protection for user $body.properties.userPrincipalName$
   mitre_attack_id:
+  - T1586
+  - T1586.003
   - T1110
   - T1110.003
   nist:
diff --git a/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml b/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml
index d813551d8c..03b350e50d 100644
--- a/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml
+++ b/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml
@@ -37,6 +37,8 @@ tags:
   - Exploitation
   message: User $body.properties.userPrincipalName$ failed to pass MFA challenge
   mitre_attack_id:
+  - T1586
+  - T1586.003
   - T1078
   - T1078.004
   - T1621
diff --git a/detections/cloud/azure_ad_multi_factor_authentication_disabled.yml b/detections/cloud/azure_ad_multi_factor_authentication_disabled.yml
index 671367235c..53d62a92a0 100644
--- a/detections/cloud/azure_ad_multi_factor_authentication_disabled.yml
+++ b/detections/cloud/azure_ad_multi_factor_authentication_disabled.yml
@@ -44,7 +44,10 @@ tags:
   - Actions on Objectives
   message: MFA disabled for User $userPrincipalName$ initiated by $initiatedBy$  
   mitre_attack_id:
+  - T1586
+  - T1586.003
   - T1556
+  - T1556.006
   nist:
   - DE.CM
   observable:
diff --git a/detections/cloud/azure_ad_multiple_failed_mfa_requests_for_user.yml b/detections/cloud/azure_ad_multiple_failed_mfa_requests_for_user.yml
index 1cdf572c42..81ca51d4c8 100644
--- a/detections/cloud/azure_ad_multiple_failed_mfa_requests_for_user.yml
+++ b/detections/cloud/azure_ad_multiple_failed_mfa_requests_for_user.yml
@@ -45,6 +45,8 @@ tags:
   - Exploitation
   message: Multiple Failed MFA requests for user $body.properties.userPrincipalName$
   mitre_attack_id:
+  - T1586
+  - T1586.003
   - T1621
   - T1078
   - T1078.004 
diff --git a/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml b/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml
index 5b50c35122..4dd30a3070 100644
--- a/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml
+++ b/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml
@@ -45,6 +45,8 @@ tags:
   - Exploitation
   message: Source Ip $body.properties.ipAddress$ failed to authenticate with 30 users within 5 minutes.
   mitre_attack_id:
+  - T1586
+  - T1586.003
   - T1110
   - T1110.003
   nist:
diff --git a/detections/cloud/azure_ad_successful_powershell_authentication.yml b/detections/cloud/azure_ad_successful_powershell_authentication.yml
index 64a8557e95..78eb405972 100644
--- a/detections/cloud/azure_ad_successful_powershell_authentication.yml
+++ b/detections/cloud/azure_ad_successful_powershell_authentication.yml
@@ -39,6 +39,8 @@ tags:
   - Exploitation
   message: Successful authentication for user $body.properties.userPrincipalName$ using PowerShell.
   mitre_attack_id:
+  - T1586
+  - T1586.003
   - T1078
   - T1078.004
   nist:
diff --git a/detections/cloud/azure_ad_successful_single_factor_authentication.yml b/detections/cloud/azure_ad_successful_single_factor_authentication.yml
index fccef2afd6..be10cc0841 100644
--- a/detections/cloud/azure_ad_successful_single_factor_authentication.yml
+++ b/detections/cloud/azure_ad_successful_single_factor_authentication.yml
@@ -37,6 +37,8 @@ tags:
   - Exploitation
   message: Successful authentication for user $body.properties.userPrincipalName$ without MFA
   mitre_attack_id:
+  - T1586
+  - T1586.003
   - T1078
   - T1078.004
   nist:
diff --git a/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml b/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml
index 6759e7ce17..20a46ee1f5 100644
--- a/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml
+++ b/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml
@@ -53,8 +53,11 @@ tags:
   - Exploitation
   message: Possible Password Spraying attack against Azure AD from source ip $body.properties.ipAddress$
   mitre_attack_id:
+  - T1586
+  - T1586.003
   - T1110
   - T1110.003
+  - T1110.004
   nist:
   - DE.CM
   observable:
diff --git a/detections/cloud/detect_aws_console_login_by_new_user.yml b/detections/cloud/detect_aws_console_login_by_new_user.yml
index 53bb8272de..94d7a49c47 100644
--- a/detections/cloud/detect_aws_console_login_by_new_user.yml
+++ b/detections/cloud/detect_aws_console_login_by_new_user.yml
@@ -37,6 +37,8 @@ tags:
   cis20:
   - CIS 16
   mitre_attack_id:
+  - T1586
+  - T1586.003
   - T1552
   confidence: 60
   context:
diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml
index 497e808482..8e9b146e12 100644
--- a/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml
+++ b/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml
@@ -62,6 +62,8 @@ tags:
   message: User $user$ is logging into the AWS console from City $City$ for the first
     time
   mitre_attack_id:
+  - T1586
+  - T1586.003
   - T1535
   nist:
   - DE.DP
diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml
index 58211f1cc2..e7c56a9109 100644
--- a/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml
+++ b/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml
@@ -63,6 +63,8 @@ tags:
   message: User $user$ is logging into the AWS console from Country $Country$ for
     the first time
   mitre_attack_id:
+  - T1586
+  - T1586.003
   - T1535
   nist:
   - DE.DP
diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml
index b423a1574d..e488247f0d 100644
--- a/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml
+++ b/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml
@@ -62,6 +62,8 @@ tags:
   message: User $user$ is logging into the AWS console from Region $Region$ for the
     first time
   mitre_attack_id:
+  - T1586
+  - T1586.003
   - T1535
   nist:
   - DE.DP
diff --git a/detections/cloud/gcp_authentication_failed_during_mfa_challenge.yml b/detections/cloud/gcp_authentication_failed_during_mfa_challenge.yml
index e6b4cea182..ef1ffecf14 100644
--- a/detections/cloud/gcp_authentication_failed_during_mfa_challenge.yml
+++ b/detections/cloud/gcp_authentication_failed_during_mfa_challenge.yml
@@ -35,6 +35,8 @@ tags:
   - Exploitation
   message: User $user$ failed to pass MFA challenge
   mitre_attack_id:
+  - T1586
+  - T1586.003
   - T1078
   - T1078.004
   - T1621
diff --git a/detections/cloud/gcp_multi_factor_authentication_disabled.yml b/detections/cloud/gcp_multi_factor_authentication_disabled.yml
index c135ab0a14..e35f411f80 100644
--- a/detections/cloud/gcp_multi_factor_authentication_disabled.yml
+++ b/detections/cloud/gcp_multi_factor_authentication_disabled.yml
@@ -39,6 +39,8 @@ tags:
   - Actions on Objectives
   message: MFA disabled for User $user$ initiated by $actor.email$  
   mitre_attack_id:
+  - T1586
+  - T1586.003
   - T1556
   nist:
   - DE.CM
diff --git a/detections/cloud/gcp_multiple_failed_mfa_requests_for_user.yml b/detections/cloud/gcp_multiple_failed_mfa_requests_for_user.yml
index f9f772128e..b8a3edb6e3 100644
--- a/detections/cloud/gcp_multiple_failed_mfa_requests_for_user.yml
+++ b/detections/cloud/gcp_multiple_failed_mfa_requests_for_user.yml
@@ -43,6 +43,8 @@ tags:
   - Exploitation
   message: Multiple Failed MFA requests for user $user$
   mitre_attack_id:
+  - T1586
+  - T1586.003
   - T1621
   - T1078
   - T1078.004 
diff --git a/detections/cloud/gcp_multiple_users_failing_to_authenticate_from_ip.yml b/detections/cloud/gcp_multiple_users_failing_to_authenticate_from_ip.yml
index 6080732fcf..dfc30524f6 100644
--- a/detections/cloud/gcp_multiple_users_failing_to_authenticate_from_ip.yml
+++ b/detections/cloud/gcp_multiple_users_failing_to_authenticate_from_ip.yml
@@ -35,7 +35,11 @@ tags:
   - Exploitation
   message: Multiple failed login attempts against users $tried_accounts$ seen from $src_ip$
   mitre_attack_id:
+  - T1586
+  - T1586.003
+  - T1110
   - T1110.003
+  - T1110.004
   nist:
   - DE.CM
   observable:
diff --git a/detections/cloud/gcp_successful_single_factor_authentication.yml b/detections/cloud/gcp_successful_single_factor_authentication.yml
index ace2876b3a..3071c3d9c4 100644
--- a/detections/cloud/gcp_successful_single_factor_authentication.yml
+++ b/detections/cloud/gcp_successful_single_factor_authentication.yml
@@ -36,6 +36,8 @@ tags:
   - Exploitation
   message: Successful authentication for user $user$ without MFA
   mitre_attack_id:
+  - T1586
+  - T1586.003
   - T1078
   - T1078.004
   nist:
diff --git a/detections/cloud/gcp_unusual_number_of_failed_authentications_from_ip.yml b/detections/cloud/gcp_unusual_number_of_failed_authentications_from_ip.yml
index 3673b54a81..d811d18b9b 100644
--- a/detections/cloud/gcp_unusual_number_of_failed_authentications_from_ip.yml
+++ b/detections/cloud/gcp_unusual_number_of_failed_authentications_from_ip.yml
@@ -39,7 +39,11 @@ tags:
   - Exploitation
   message: Unusual number of failed console login attempts against users $tried_accounts$ seen from $src_ip$
   mitre_attack_id:
+  - T1586
+  - T1586.003
+  - T1110
   - T1110.003
+  - T1110.004
   nist:
   - DE.CM
   observable:
diff --git a/detections/endpoint/rubeus_command_line_parameters.yml b/detections/endpoint/rubeus_command_line_parameters.yml
index 467f1a88c0..730da1784d 100644
--- a/detections/endpoint/rubeus_command_line_parameters.yml
+++ b/detections/endpoint/rubeus_command_line_parameters.yml
@@ -17,7 +17,7 @@ description: Rubeus is a C# toolset for raw Kerberos interaction and abuses. It
   this analytic.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process = "*ptt /ticket*"
-  OR Processes.process = "* monitor *" OR Processes.process ="* asktgt* /user:*" OR
+  OR Processes.process = "* monitor /interval*" OR Processes.process ="* asktgt* /user:*" OR
   Processes.process ="* asktgs* /service:*" OR Processes.process ="* golden* /user:*"
   OR Processes.process ="* silver* /service:*" OR Processes.process ="* kerberoast*"
   OR Processes.process ="* asreproast*" OR Processes.process = "* renew* /ticket:*"

From b8d9c4c6fd7a2350a6ee918a4ca12719ac419381 Mon Sep 17 00:00:00 2001
From: mvelazco <mauricio.velazco@gmail.com>
Date: Fri, 4 Nov 2022 13:48:00 -0400
Subject: [PATCH 6/7] moving detection to experimental

---
 .../cloud/detect_aws_console_login_by_new_user.yml                | 0
 .../cloud/detect_aws_console_login_by_new_user.test.yml           | 0
 2 files changed, 0 insertions(+), 0 deletions(-)
 rename detections/{ => experimental}/cloud/detect_aws_console_login_by_new_user.yml (100%)
 rename tests/{ => experimental}/cloud/detect_aws_console_login_by_new_user.test.yml (100%)

diff --git a/detections/cloud/detect_aws_console_login_by_new_user.yml b/detections/experimental/cloud/detect_aws_console_login_by_new_user.yml
similarity index 100%
rename from detections/cloud/detect_aws_console_login_by_new_user.yml
rename to detections/experimental/cloud/detect_aws_console_login_by_new_user.yml
diff --git a/tests/cloud/detect_aws_console_login_by_new_user.test.yml b/tests/experimental/cloud/detect_aws_console_login_by_new_user.test.yml
similarity index 100%
rename from tests/cloud/detect_aws_console_login_by_new_user.test.yml
rename to tests/experimental/cloud/detect_aws_console_login_by_new_user.test.yml

From c87d793e4825829a1d364fe9efac30c74454f1d2 Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Tue, 8 Nov 2022 12:56:46 -0800
Subject: [PATCH 7/7] remove datamodel

---
 .../aws_multiple_users_failing_to_authenticate_from_ip.yml     | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml b/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml
index bc190d62c8..2526a342ff 100644
--- a/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml
+++ b/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml
@@ -4,8 +4,7 @@ version: 1
 date: '2022-09-27'
 author: Bhavin Patel
 type: Anomaly
-datamodel:
-- Endpoint
+datamodel: []
 description: The following analytic identifies one source Ip failing to authenticate into the AWS Console with 30 unique valid users within 10 minutes. This behavior could represent an adversary performing a Password Spraying attack against an AWS environment tenant to obtain initial access or elevate privileges. 
 search: '`cloudtrail` eventName=ConsoleLogin action=failure | bucket span=10m _time | stats  dc(_raw) AS unique_accounts values(user_name) as tried_accounts by _time, src_ip, eventName, action, user_agent |  where unique_accounts > 30 |`aws_unusual_number_of_failed_authentications_from_ip_filter`'
 how_to_implement: You must install Splunk Add-on for AWS in order to ingest Cloudtrail. We recommend the users to try different combinations of the bucket span time and the tried account threshold to tune this search according to their environment.