diff --git a/detections/web/microsoft_sharepoint_server_elevation_of_privilege.yml b/detections/web/microsoft_sharepoint_server_elevation_of_privilege.yml
index 340028152c..412ccf3d07 100644
--- a/detections/web/microsoft_sharepoint_server_elevation_of_privilege.yml
+++ b/detections/web/microsoft_sharepoint_server_elevation_of_privilege.yml
@@ -8,7 +8,7 @@ type: TTP
 data_source: []
 description: This analytic detects potential exploitation attempts against Microsoft SharePoint Server vulnerability CVE-2023-29357. This vulnerability pertains to an elevation of privilege due to improper handling of authentication tokens. By monitoring for suspicious activities related to SharePoint Server, the analytic identifies attempts to exploit this vulnerability. If a true positive is detected, it indicates a serious security breach where an attacker might have gained privileged access to the SharePoint environment, potentially leading to data theft or other malicious activities.
 search: '| tstats count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Web where Web.url IN ("/_api/web/siteusers*","/_api/web/currentuser*") 
+  as lastTime from datamodel=Web where Web.url IN ("/_api/web/siteusers*","/_api/web/currentuser*") Web.status=200 Web.http_method=GET
   by Web.http_user_agent, Web.status Web.http_method, Web.url, Web.url_length, Web.src, Web.dest, sourcetype
   | `drop_dm_object_name("Web")`
   | `security_content_ctime(firstTime)` 
@@ -18,6 +18,7 @@ how_to_implement: This detection requires the Web datamodel to be populated from
 known_false_positives: False positives may occur if there are legitimate activities that mimic the exploitation pattern. It's recommended to review the context of the alerts and adjust the analytic parameters to better fit the specific environment.
 references:
 - https://socradar.io/microsoft-sharepoint-server-elevation-of-privilege-vulnerability-exploit-cve-2023-29357/
+- https://github.com/LuemmelSec/CVE-2023-29357/blob/main/CVE-2023-29357/Program.cs
 tags:
   cve:
   - CVE-2023-29357
diff --git a/detections/web/ws_ftp_remote_code_execution.yml b/detections/web/ws_ftp_remote_code_execution.yml
index e804743b1a..fd40b6ee7c 100644
--- a/detections/web/ws_ftp_remote_code_execution.yml
+++ b/detections/web/ws_ftp_remote_code_execution.yml
@@ -14,10 +14,11 @@ search: '| tstats count min(_time) as firstTime max(_time)
   | `security_content_ctime(firstTime)` 
   | `security_content_ctime(lastTime)` | `ws_ftp_remote_code_execution_filter`'
 how_to_implement: The following analytic requires the Web datamodel. Ensure data source is mapped correctly or modify and tune for your data source.
-known_false_positives: If WS_FTP Server is not in use, this analytic will not return results. Monitor and tune for your environment.
+known_false_positives: If WS_FTP Server is not in use, this analytic will not return results. Monitor and tune for your environment. Note the MetaSploit module is focused on only hitting /AHT/ and not the full /AHT/AhtApiService.asmx/AuthUser URL.
 references:
 - https://github.com/projectdiscovery/nuclei-templates/pull/8296/files
 - https://www.assetnote.io/resources/research/rce-in-progress-ws-ftp-ad-hoc-via-iis-http-modules-cve-2023-40044
+- https://github.com/rapid7/metasploit-framework/pull/18414
 tags:
   cve:
   - CVE-2023-40044