diff --git a/bin/generate.py b/bin/generate.py
index f10dbb80da..c793e19743 100644
--- a/bin/generate.py
+++ b/bin/generate.py
@@ -606,6 +606,7 @@ def write_analytics_story_confv1(stories, detections, investigations, baselines,
         output_file.write("version = %s\n" % story['version'])
         output_file.write("reference = %s\n" % json.dumps(story['references']))
 
+        # write all detections
         if 'detections' in story:
             detection_searches = []
             for d in story['detections']:
@@ -613,6 +614,15 @@ def write_analytics_story_confv1(stories, detections, investigations, baselines,
                     detection_searches.append("ESCU - " + d['name'] + " - Rule")
             output_file.write("detection_searches = %s\n" % json.dumps(detection_searches))
 
+        # grab mappings
+        mappings = dict()
+        for detection_name, detection in sorted(detections.iteritems()):
+            for s in detection['stories']:
+                if s == story_name and detection['type'] == 'splunk':
+                    for key in detection['mappings'].keys():
+                        mappings[key] = list(detection['mappings'][key])
+        output_file.write("mappings = {0}\n".format(json.dumps(mappings)))
+
         # write all investigations
         total_investigations = []
         for investigation_name, investigation in sorted(investigations.iteritems()):
diff --git a/src/default/analytic_stories.conf b/src/default/analytic_stories.conf
index 88976dd694..c46e9ad067 100644
--- a/src/default/analytic_stories.conf
+++ b/src/default/analytic_stories.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security-content
-# On Date: 2019-04-22T23:02:58 UTC
+# On Date: 2019-04-23T17:04:41 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -13,8 +13,9 @@ id = 2f2f610a-d64d-48c2-b57c-967a2b49ab5a
 version = 1.0
 reference = ["https://aws.amazon.com/blogs/security/aws-cloudtrail-now-tracks-cross-account-activity-to-its-origin/"]
 detection_searches = ["ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule"]
-investigative_searches = ["ESCU - Get Notable History", "ESCU - AWS Investigate User Activities By AccessKeyId", "ESCU - AWS Investigate User Activities By Source User"]
-support_searches = ["ESCU - Previously Seen AWS Cross Account Activity"]
+mappings = {"mitre_attack": ["Credential Access"], "cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.AC", "PR.DS", "DE.AE"]}
+investigative_searches = ["AWS Investigate User Activities By AccessKeyId", "AWS Investigate User Activities By Source User", "Get Notable History"]
+support_searches = ["Previously Seen AWS Cross Account Activity"]
 data_models = []
 description = Track when a user assumes an IAM role in another AWS account to obtain cross-account access to services and resources in that account. Accessing new roles could be an indication of malicious activity.
 narrative = Amazon Web Services (AWS) admins manage access to AWS resources and services across the enterprise using AWS's Identity and Access Management (IAM) functionality. IAM provides the ability to create and manage AWS users, groups, and roles-each with their own unique set of privileges and defined access to specific resources (such as EC2 instances, the AWS Management Console, API, or the command-line interface). Unlike conventional (human) users, IAM roles are assumable by anyone in the organization. They provide users with dynamically created temporary security credentials that expire within a set time period.\
@@ -31,8 +32,9 @@ id = ced74200-8465-4bc3-bd2c-9a782eec6750
 version = 1.0
 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
 detection_searches = ["ESCU - EC2 Instance Started In Previously Unseen Region - Rule", "ESCU - Abnormally High AWS Instances Launched by User - Rule", "ESCU - EC2 Instance Started With Previously Unseen Instance Type - Rule", "ESCU - EC2 Instance Started With Previously Unseen AMI - Rule", "ESCU - EC2 Instance Started With Previously Unseen User - Rule"]
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get EC2 Instance Details by instanceId", "ESCU - Investigate AWS activities via region name", "ESCU - AWS Investigate User Activities By ARN", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get EC2 Instance Details by instanceId", "ESCU - Investigate AWS activities via region name", "ESCU - AWS Investigate User Activities By ARN", "ESCU - Get EC2 Launch Details", "ESCU - Get EC2 Launch Details", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get EC2 Instance Details by instanceId", "ESCU - Investigate AWS activities via region name", "ESCU - AWS Investigate User Activities By ARN"]
-support_searches = ["ESCU - Previously Seen AWS Regions", "ESCU - Previously Seen EC2 Launches By User", "ESCU - Previously Seen AWS Regions", "ESCU - Previously Seen EC2 Launches By User", "ESCU - Previously Seen AWS Regions", "ESCU - Previously Seen EC2 Launches By User", "ESCU - Previously Seen EC2 Instance Types", "ESCU - Previously Seen EC2 AMIs", "ESCU - Previously Seen AWS Regions", "ESCU - Previously Seen EC2 Launches By User", "ESCU - Previously Seen EC2 Instance Types", "ESCU - Previously Seen EC2 AMIs", "ESCU - Previously Seen AWS Regions", "ESCU - Previously Seen EC2 Launches By User"]
+mappings = {"mitre_attack": ["Defense Evasion"], "cis20": ["CIS 1"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["ID.AM"]}
+investigative_searches = ["Get EC2 Launch Details"]
+support_searches = ["Previously Seen AWS Regions", "Previously Seen EC2 AMIs", "Previously Seen EC2 Instance Types", "Previously Seen EC2 Launches By User"]
 data_models = []
 description = Monitor your AWS EC2 instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or EC2 instances started by previously unseen users are just a few examples of potentially malicious behavior.
 narrative = Cryptomining is an intentionally difficult, resource-intensive business. Its complexity was designed into the process to ensure that the number of blocks mined each day would remain steady. So, it's par for the course that ambitious, but unscrupulous, miners make amassing the computing power of large enterprises--a practice known as cryptojacking--a top priority. \
@@ -51,8 +53,9 @@ id = 2e8948a5-5239-406b-b56b-6c50ff268af4
 version = 2.0
 reference = ["https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Appendix_NACLs.html", "https://aws.amazon.com/blogs/security/how-to-help-prepare-for-ddos-attacks-by-reducing-your-attack-surface/"]
 detection_searches = ["ESCU - AWS Network Access Control List Created with All Open Ports - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Detect Spike in Network ACL Activity - Rule"]
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - AWS Network ACL Details from ID", "ESCU - AWS Network Interface details via resourceId", "ESCU - AWS Investigate User Activities By ARN", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - AWS Network ACL Details from ID", "ESCU - AWS Network Interface details via resourceId", "ESCU - AWS Investigate User Activities By ARN", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - AWS Network Interface details via resourceId", "ESCU - Get All AWS Activity From IP Address", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - AWS Network ACL Details from ID", "ESCU - AWS Network Interface details via resourceId", "ESCU - AWS Investigate User Activities By ARN"]
-support_searches = ["ESCU - Baseline of blocked outbound traffic from AWS", "ESCU - Baseline of Network ACL Activity by ARN", "ESCU - Baseline of blocked outbound traffic from AWS", "ESCU - Baseline of Network ACL Activity by ARN", "ESCU - Baseline of blocked outbound traffic from AWS", "ESCU - Baseline of blocked outbound traffic from AWS", "ESCU - Baseline of Network ACL Activity by ARN"]
+mappings = {"mitre_attack": ["Exfiltration", "Command and Control"], "cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "nist": ["DE.AE", "DE.CM", "PR.AC"]}
+investigative_searches = ["AWS Investigate User Activities By ARN", "AWS Network ACL Details from ID", "AWS Network Interface details via resourceId", "Get Notable History", "Get Notable Info", "Get User Information from Identity Table"]
+support_searches = ["Baseline of Network ACL Activity by ARN", "Baseline of blocked outbound traffic from AWS"]
 data_models = []
 description = Monitor your AWS network infrastructure for bad configurations and malicious activity. Investigative searches help you probe deeper, when the facts warrant it.
 narrative = AWS CloudTrail is an AWS service that helps you enable governance, compliance, and operational/risk auditing of your AWS account. Actions taken by a user, role, or an AWS service are recorded as events in CloudTrail. It is crucial for a company to monitor events and actions taken in the AWS Management Console, AWS Command Line Interface, and AWS SDKs and APIs to ensure that your servers are not vulnerable to attacks. This analytic story contains detection searches that leverage CloudTrail logs from AWS to check for bad configurations and malicious activity in your AWS network access controls.
@@ -65,8 +68,9 @@ id = 3338b567-3804-4261-9889-cf0ca4753c7f
 version = 1.0
 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
 detection_searches = ["ESCU - AWS Cloud Provisioning From Previously Unseen Country - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen Region - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen City - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen IP Address - Rule"]
-investigative_searches = ["ESCU - Get All AWS Activity From City", "ESCU - Get All AWS Activity From Country", "ESCU - Get All AWS Activity From Region", "ESCU - Get All AWS Activity From IP Address", "ESCU - Get All AWS Activity From City", "ESCU - Get All AWS Activity From Country", "ESCU - Get All AWS Activity From Region", "ESCU - Get All AWS Activity From IP Address", "ESCU - Get All AWS Activity From City", "ESCU - Get All AWS Activity From Country", "ESCU - Get All AWS Activity From Region", "ESCU - Get All AWS Activity From IP Address", "ESCU - Get All AWS Activity From City", "ESCU - Get All AWS Activity From Country", "ESCU - Get All AWS Activity From Region", "ESCU - Get All AWS Activity From IP Address"]
-support_searches = ["ESCU - Previously Seen AWS Provisioning Activity Sources", "ESCU - Previously Seen AWS Provisioning Activity Sources", "ESCU - Previously Seen AWS Provisioning Activity Sources", "ESCU - Previously Seen AWS Provisioning Activity Sources"]
+mappings = {"cis20": ["CIS 1"], "nist": ["ID.AM"]}
+investigative_searches = ["Get All AWS Activity From City", "Get All AWS Activity From Country", "Get All AWS Activity From IP Address", "Get All AWS Activity From Region"]
+support_searches = ["Previously Seen AWS Provisioning Activity Sources"]
 data_models = []
 description = Monitor your AWS provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your network.
 narrative = Because most enterprise AWS activities originate from familiar geographic locations, monitoring for activity from unknown or unusual regions is an important security measure. This indicator can be especially useful in environments where it is impossible to whitelist specific IPs (because they vary).\
@@ -81,8 +85,9 @@ id = 2e8948a5-5239-406b-b56b-6c50f1269af3
 version = 1.0
 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://blog.redlock.io/cryptojacking-tesla"]
 detection_searches = ["ESCU - Detect AWS API Activities From Unapproved Accounts - Rule", "ESCU - Detect Spike in AWS API Activity - Rule", "ESCU - Detect new API calls from user roles - Rule", "ESCU - Detect Spike in Security Group Activity - Rule", "ESCU - Detect API activity from users without MFA - Rule"]
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Investigate AWS User Activities by user field", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Investigate AWS User Activities by user field", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Investigate AWS User Activities by user field", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Investigate AWS User Activities by user field", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Investigate AWS User Activities by user field"]
-support_searches = ["ESCU - Create a list of approved AWS service accounts", "ESCU - Baseline of API Calls per User ARN", "ESCU - Previously seen API call per user roles in CloudTrail", "ESCU - Baseline of Security Group Activity by ARN", "ESCU - Create a list of approved AWS service accounts", "ESCU - Baseline of API Calls per User ARN", "ESCU - Previously seen API call per user roles in CloudTrail", "ESCU - Baseline of Security Group Activity by ARN", "ESCU - Create a list of approved AWS service accounts", "ESCU - Baseline of API Calls per User ARN", "ESCU - Previously seen API call per user roles in CloudTrail", "ESCU - Baseline of Security Group Activity by ARN", "ESCU - Create a list of approved AWS service accounts", "ESCU - Baseline of API Calls per User ARN", "ESCU - Previously seen API call per user roles in CloudTrail", "ESCU - Baseline of Security Group Activity by ARN", "ESCU - Create a list of approved AWS service accounts", "ESCU - Baseline of API Calls per User ARN", "ESCU - Previously seen API call per user roles in CloudTrail", "ESCU - Baseline of Security Group Activity by ARN"]
+mappings = {"mitre_attack": ["Credential Access", "Execution"], "kill_chain_phases": ["Actions on Objectives"], "cis20": ["CIS 1"], "nist": ["ID.AM"]}
+investigative_searches = ["Get Notable History", "Get Notable Info", "Investigate AWS User Activities by user field"]
+support_searches = ["Baseline of API Calls per User ARN", "Baseline of Security Group Activity by ARN", "Create a list of approved AWS service accounts", "Previously seen API call per user roles in CloudTrail"]
 data_models = []
 description = Detect and investigate dormant user accounts for your AWS environment that have become active again. Because inactive and ad-hoc accounts are common attack targets, it's critical to enable governance within your environment.
 narrative = It seems obvious that it is critical to monitor and control the users who have access to your cloud infrastructure. Nevertheless, it's all too common for enterprises to lose track of ad-hoc accounts, leaving their servers vulnerable to attack. In fact, this was the very oversight that led to Tesla's cryptojacking attack in February, 2018.\
@@ -101,9 +106,10 @@ id = 8892a655-6205-55f7-abba-06460e38c8ae
 version = 1.0
 reference = ["https://www.sans.org/media/critical-security-controls/critical-controls-poster-2016.pdf"]
 detection_searches = ["ESCU - Identify New User Accounts - Rule", "ESCU - Short Lived Windows Accounts - Rule", "ESCU - Detect Excessive Account Lockouts From Endpoint - Rule", "ESCU - Detect Excessive User Account Lockouts - Rule"]
-investigative_searches = ["ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Logon Rights Modifications For User", "ESCU - Get Logon Rights Modifications For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Logon Rights Modifications For User", "ESCU - Get Logon Rights Modifications For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Logon Rights Modifications For User", "ESCU - Get Logon Rights Modifications For Endpoint"]
+mappings = {"mitre_attack": ["Valid Accounts"], "cis20": ["CIS 16"], "nist": ["PR.IP"]}
+investigative_searches = ["Get Authentication Logs For Endpoint", "Get Logon Rights Modifications For Endpoint", "Get Logon Rights Modifications For User", "Get Notable History", "Get Notable Info", "Get Risk Modifiers For Endpoint", "Get Risk Modifiers For User", "Get User Information from Identity Table"]
 support_searches = []
-data_models = [[u'Identity_Management'], [u'Change_Analysis'], [u'Change'], [u'Change']]
+data_models = ["Change", "Change_Analysis", "Identity_Management"]
 description = A common attack technique is to leverage user accounts to gain unauthorized access to the target's network. This Analytic Story minimizes opportunities for attack by helping you actively manage creation/use/dormancy/deletion--the lifecycle of system and application accounts.
 narrative = Monitoring user accounts within your enterprise is a critical analytic function that helps ensure that credential and access policies/procedures are properly implemented and are being enforced. Proactive ad-hoc hunting, as well as routine monitoring, can ensure user or system accounts are not being abused by unauthorized individuals or processes. In the event of a network event or breach, user-authentication logs are a key resource in determining if or how an account might have been compromised or co-opted, leading to suspicious or malicious activity.
 
@@ -115,9 +121,10 @@ id = 2dcfd6a2-e7d2-4873-b6ba-adaf819d2a1e
 version = 1.0
 reference = ["http://blog.talosintelligence.com/2017/03/apache-0-day-exploited.html", "https://github.com/SpiderLabs/owasp-modsecurity-crs/blob/v3.2/dev/rules/REQUEST-944-APPLICATION-ATTACK-JAVA.conf"]
 detection_searches = ["ESCU - Unusually Long Content-Type Length - Rule", "ESCU - Web Servers Executing Suspicious Processes - Rule", "ESCU - Suspicious Java Classes - Rule"]
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Investigate Suspicious Strings in HTTP Header", "ESCU - Investigate Web POSTs From src", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Investigate Suspicious Strings in HTTP Header", "ESCU - Investigate Web POSTs From src", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Investigate Suspicious Strings in HTTP Header", "ESCU - Investigate Web POSTs From src"]
+mappings = {"mitre_attack": ["Defense Evasion", "Exploitation of Vulnerability", "Execution", "Discovery", "System Information Discovery"], "cis20": ["CIS 3"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.IP"]}
+investigative_searches = ["Get Authentication Logs For Endpoint", "Get Notable History", "Get Notable Info", "Get Risk Modifiers For Endpoint", "Get Risk Modifiers For User", "Get User Information from Identity Table", "Investigate Suspicious Strings in HTTP Header", "Investigate Web POSTs From src"]
 support_searches = []
-data_models = [[u'Endpoint']]
+data_models = ["Endpoint"]
 description = Detect and investigate activities--such as unusually long `Content-Type` length, suspicious java classes and web servers executing suspicious processes--consistent with attempts to exploit Apache Struts vulnerabilities.
 narrative = In March of 2017, a remote code-execution vulnerability in the Jakarta Multipart parser in Apache Struts, a widely used open-source framework for creating Java web applications, was disclosed and assigned to CVE-2017-5638. About two months later, hackers exploited the flaw to carry out the world's <a href=https://www.usatoday.com/story/tech/2017/09/07/nations-biggest-hacks-and-data-breaches-millions/644311001/> 5th largest data breach</a>. The target, credit giant Equifax, <a href=https://money.cnn.com/2017/09/16/technology/equifax-breach-security-hole/index.html>told investigators</a> that it had become aware of the vulnerability two months before the attack. \
 \
@@ -155,9 +162,10 @@ id = 91c676cf-0b23-438d-abee-f6335e1fce77
 version = 1.0
 reference = ["https://www.cisecurity.org/controls/inventory-of-authorized-and-unauthorized-devices/"]
 detection_searches = ["ESCU - Detect Unauthorized Assets by MAC address - Rule"]
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get First Occurrence and Last Occurrence of a MAC Address", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint"]
-support_searches = ["ESCU - Count of assets by category"]
-data_models = [[u'Network_Sessions']]
+mappings = {"mitre_attack": ["Defense Evasion"], "cis20": ["CIS 1"], "kill_chain_phases": ["Reconnaissance", "Delivery", "Actions on Objectives"], "nist": ["ID.AM", "PR.DS"]}
+investigative_searches = ["Get Authentication Logs For Endpoint", "Get First Occurrence and Last Occurrence of a MAC Address", "Get Notable History", "Get Notable Info", "Get Risk Modifiers For Endpoint", "Get Risk Modifiers For User", "Get User Information from Identity Table"]
+support_searches = ["Count of assets by category"]
+data_models = ["Network_Sessions"]
 description = Keep a careful inventory of every asset on your network to make it easier to detect rogue devices. Unauthorized/unmanaged devices could be an indication of malicious behavior that should be investigated further.
 narrative = This Analytic Story is designed to help you develop a better understanding of what authorized and unauthorized devices are part of your enterprise. This story can help you better categorize and classify assets, providing critical business context and awareness of their assets during an incident. Information derived from this Analytic Story can be used to better inform and support other analytic stories. For successful detection, you will need to leverage the Assets and Identity Framework from Enterprise Security to populate your known assets.
 
@@ -169,9 +177,10 @@ id = 91c676cf-0b23-438d-abee-f6335e1fce78
 version = 1.0
 reference = ["https://blog.domaintools.com/tag/brand-monitor/", "https://securingtomorrow.mcafee.com/consumer/family-safety/what-is-typosquatting/", "https://blog.malwarebytes.com/cybercrime/2016/06/explained-typosquatting/"]
 detection_searches = ["ESCU - Monitor DNS For Brand Abuse - Rule", "ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Monitor Web Traffic For Brand Abuse - Rule"]
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Email Info", "ESCU - Get Emails From Specific Sender", "ESCU - Investigate Web Activity From Host", "ESCU - Get DNS Server History for a host", "ESCU - Get Process responsible for the DNS traffic", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Email Info", "ESCU - Get Emails From Specific Sender", "ESCU - Investigate Web Activity From Host", "ESCU - Get DNS Server History for a host", "ESCU - Get Process responsible for the DNS traffic", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Email Info", "ESCU - Get Emails From Specific Sender", "ESCU - Investigate Web Activity From Host", "ESCU - Get DNS Server History for a host", "ESCU - Get Process responsible for the DNS traffic"]
-support_searches = ["ESCU - DNSTwist Domain Names", "ESCU - DNSTwist Domain Names", "ESCU - DNSTwist Domain Names"]
-data_models = [[u'Network_Resolution'], [u'Email'], [u'Web']]
+mappings = {"mitre_attack": [], "cis20": ["CIS 7"], "kill_chain_phases": ["Delivery"], "nist": ["PR.IP"]}
+investigative_searches = ["Get Authentication Logs For Endpoint", "Get DNS Server History for a host", "Get Email Info", "Get Emails From Specific Sender", "Get Notable History", "Get Notable Info", "Get Process responsible for the DNS traffic", "Get Risk Modifiers For Endpoint", "Get Risk Modifiers For User", "Get User Information from Identity Table", "Investigate Web Activity From Host"]
+support_searches = ["DNSTwist Domain Names"]
+data_models = ["Email", "Network_Resolution", "Web"]
 description = Detect and investigate activity that may indicate that an adversary is using faux domains to mislead users into interacting with malicious infrastructure. Monitor DNS, email, and web traffic for permutations of your brand name.
 narrative = While you can educate your users and customers about the risks and threats posed by typosquatting, phishing, and corporate espionage, human error is a persistent fact of life. Of course, your adversaries are all too aware of this reality and will happily leverage it for nefarious purposes whenever possible&#51;phishing with lookalike addresses, embedding faux command-and-control domains in malware, and hosting malicious content on domains that closely mimic your corporate servers. This is where brand monitoring comes in.\
 \
@@ -187,9 +196,10 @@ id = bd91a2bc-d20b-4f44-a982-1bea98e86390
 version = 1.0
 reference = ["https://www.intego.com/mac-security-blog/osxcoldroot-and-the-rat-invasion/", "https://objective-see.com/blog/blog_0x2A.html", "https://www.bleepingcomputer.com/news/security/coldroot-rat-still-undetectable-despite-being-uploaded-on-github-two-years-ago/"]
 detection_searches = ["ESCU - Processes Tapping Keyboard Events - Rule", "ESCU - Osquery pack - ColdRoot detection - Rule"]
-investigative_searches = ["ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Investigate Network Traffic From src_ip", "ESCU - Investigate Web Activity From src_ip", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Investigate Network Traffic From src_ip", "ESCU - Investigate Web Activity From src_ip"]
+mappings = {"mitre_attack": ["Collection"], "cis20": ["CIS 4", "CIS 8"], "kill_chain_phases": ["Command and Control"], "nist": ["DE.DP"]}
+investigative_searches = ["Get Authentication Logs For Endpoint", "Get Notable History", "Get Risk Modifiers For Endpoint", "Get Risk Modifiers For User", "Get User Information from Identity Table", "Get Vulnerability Logs For Endpoint", "Investigate Network Traffic From src_ip", "Investigate Web Activity From src_ip"]
 support_searches = []
-data_models = [[u'Alerts'], [u'Alerts']]
+data_models = ["Alerts"]
 description = Leverage searches that allow you to detect and investigate unusual activities that relate to the ColdRoot Remote Access Trojan that affects MacOS. An example of some of these activities are changing sensative binaries in the MacOS sub-system, detecting process names and executables associated with the RAT, detecting when a keyboard tab is installed on a MacOS machine and more.
 narrative = Conventional wisdom holds that Apple's MacOS operating system is significantly less vulnerable to attack than Windows machines. While that point is debatable, it is true that attacks against MacOS systems are much less common. However, this fact does not mean that Macs are impervious to breaches. To the contrary, research has shown that that Mac malware is increasing at an alarming rate. According to AV-test, in 2018, there were 86,865 new MacOS malware variants, up from 27,338 the year before&#151;a 31% increase. In contrast, the independent research firm found that new Windows malware had increased from 65.17M to 76.86M during that same period, less than half the rate of growth. The bottom line is that while the numbers look a lot smaller than Windows, it's definitely time to take Mac security more seriously.\
 \
@@ -205,9 +215,10 @@ id = 8e03c61e-13c4-4dcd-bfbe-5ce5a8dc031a
 version = 1.0
 reference = ["https://attack.mitre.org/wiki/Collection", "https://attack.mitre.org/wiki/Technique/T1074"]
 detection_searches = ["ESCU - Suspicious writes to windows Recycle Bin - Rule", "ESCU - Suspicious writes to System Volume Information - Rule", "ESCU - Email files written outside of the Outlook directory - Rule", "ESCU - Hosts receiving high volume of network traffic from email server - Rule", "ESCU - Email servers sending high volume traffic to hosts - Rule"]
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info"]
+mappings = {"mitre_attack": ["Collection", "Data Staged"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.CM"]}
+investigative_searches = ["Get Authentication Logs For Endpoint", "Get Notable History", "Get Notable Info", "Get Parent Process Info", "Get Process Info", "Get Risk Modifiers For Endpoint", "Get Risk Modifiers For User", "Get User Information from Identity Table"]
 support_searches = []
-data_models = [[u'Endpoint'], [u'Endpoint'], [u'Network_Traffic'], [u'Network_Traffic']]
+data_models = ["Endpoint", "Network_Traffic"]
 description = Monitor for and investigate activities--such as suspicious writes to the Windows Recycling Bin or email servers sending high amounts of traffic to specific hosts, for example--that may indicate that an adversary is harvesting and exfiltrating sensitive data.
 narrative = A common adversary goal is to identify and exfiltrate data of value from a target organization. This data may include email conversations and addresses, confidential company information, links to network design/infrastructure, important dates, and so on.\
 \
@@ -223,9 +234,10 @@ id = 943773c6-c4de-4f38-89a8-0b92f98804d8
 version = 1.0
 reference = ["https://attack.mitre.org/wiki/Command_and_Control", "https://searchsecurity.techtarget.com/feature/Command-and-control-servers-The-puppet-masters-that-govern-malware"]
 detection_searches = ["ESCU - Detect Large Outbound ICMP Packets - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule"]
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - AWS Network Interface details via resourceId", "ESCU - Get Process Info", "ESCU - Get Process responsible for the DNS traffic", "ESCU - Get DNS Server History for a host", "ESCU - Get DNS traffic ratio", "ESCU - Get All AWS Activity From IP Address", "ESCU - Get Process Information For Port Activity", "ESCU - Get Notable History", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Information For Port Activity", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get DNS Server History for a host", "ESCU - Get DNS traffic ratio", "ESCU - Get Process responsible for the DNS traffic", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Get Parent Process Info", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Get Parent Process Info", "ESCU - Get DNS Server History for a host", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get DNS Server History for a host", "ESCU - Get DNS traffic ratio", "ESCU - Get Process responsible for the DNS traffic", "ESCU - Get DNS Server History for a host", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get DNS Server History for a host", "ESCU - Get DNS traffic ratio", "ESCU - Get Process responsible for the DNS traffic", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get DNS Server History for a host", "ESCU - Get DNS traffic ratio", "ESCU - Get Process responsible for the DNS traffic", "ESCU - Get DNS Server History for a host", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - AWS Network Interface details via resourceId", "ESCU - Get All AWS Activity From IP Address"]
-support_searches = ["ESCU - Baseline of blocked outbound traffic from AWS", "ESCU - Count of Unique IPs Connecting to Ports", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes", "ESCU - Baseline of blocked outbound traffic from AWS"]
-data_models = [[u'Network_Traffic'], [u'Network_Traffic'], [u'Network_Resolution'], [u'Network_Traffic'], [u'Network_Traffic'], [u'Network_Resolution'], [u'Network_Resolution'], [u'Network_Resolution'], [u'Network_Resolution'], [u'Network_Resolution'], [u'Network_Resolution']]
+mappings = {"mitre_attack": ["Command and Control", "Commonly Used Port", "Exfiltration"], "cis20": ["CIS 9", "CIS 12"], "kill_chain_phases": ["Command and Control"], "nist": ["DE.AE"]}
+investigative_searches = ["AWS Network Interface details via resourceId", "Get All AWS Activity From IP Address", "Get Authentication Logs For Endpoint", "Get DNS Server History for a host", "Get DNS traffic ratio", "Get Notable History", "Get Notable Info", "Get Process Info", "Get Process Information For Port Activity", "Get Process responsible for the DNS traffic", "Get Risk Modifiers For Endpoint", "Get Risk Modifiers For User", "Get User Information from Identity Table"]
+support_searches = ["Baseline of blocked outbound traffic from AWS"]
+data_models = ["Network_Resolution", "Network_Traffic"]
 description = Detect and investigate tactics, techniques, and procedures leveraged by attackers to establish and operate command and control channels. Implants installed by attackers on compromised endpoints use these channels to receive instructions and send data back to the malicious operators.
 narrative = Threat actors typically architect and implement an infrastructure to use in various ways during the course of their attack campaigns. In some cases, they leverage this infrastructure for scanning and performing reconnaissance activities. In others, they may use this infrastructure to launch actual attacks. One of the most important functions of this infrastructure is to establish servers that will communicate with implants on compromised endpoints. These servers establish a command and control channel that is used to proxy data between the compromised endpoint and the attacker. These channels relay commands from the attacker to the compromised endpoint and the output of those commands back to the attacker.\
 \
@@ -239,9 +251,10 @@ id = 9a64ab44-9214-4639-8163-7eaa2621bd61
 version = 1.0
 reference = []
 detection_searches = ["ESCU - Detect DNS requests to Phishing Sites leveraging EvilGinx2 - Rule"]
-investigative_searches = ["ESCU - Get Certificate logs for a domain"]
+mappings = {"mitre_attack": ["Exfiltration", "Command and Control", "Defense Evasion", "Commonly Used Port"], "cis20": ["CIS 1", "CIS 3", "CIS 8", "CIS 12"], "kill_chain_phases": ["Delivery", "Actions on Objectives", "Command and Control"], "nist": ["ID.AM", "PR.DS", "PR.IP", "DE.AE", "DE.CM"]}
+investigative_searches = ["Get Certificate logs for a domain"]
 support_searches = []
-data_models = [[u'Network_Resolution']]
+data_models = ["Network_Resolution"]
 description = XXXX - Placeholder for Phishing description
 narrative = XXXX - Placeholder for Phishing narrative
 
@@ -253,9 +266,10 @@ id = 854d78bf-d0e2-4f4e-b05c-640905f86d7a
 version = 1.0
 reference = ["https://attack.mitre.org/wiki/Technique/T1003", "https://www.powershellempire.com/?page_id=112", "https://4iq.com/4iq-discovers-1-4-billion-clear-text-credentials-single-database/"]
 detection_searches = ["ESCU - Attempt To Set Default PowerShell Execution Policy To Unrestricted - Rule", "ESCU - Attempted Credential Dump From Registry Via Reg.exe - Rule", "ESCU - Detect Mimikatz Via PowerShell And EventCode 4703 - Rule", "ESCU - Detect Mimikatz Via PowerShell And EventCode 4663 - Rule"]
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Investigate Web Activity From Host", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Investigate Web Activity From Host", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Investigate Web Activity From Host"]
+mappings = {"mitre_attack": ["Credential Access", "Credential Dumping"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.IP", "PR.AC", "DE.CM"]}
+investigative_searches = ["Get Authentication Logs For Endpoint", "Get Notable History", "Get Notable Info", "Get Parent Process Info", "Get Process Info", "Get Risk Modifiers For Endpoint", "Get Risk Modifiers For User", "Get User Information from Identity Table", "Investigate Web Activity From Host"]
 support_searches = []
-data_models = [[u'Endpoint'], [u'Endpoint']]
+data_models = ["Endpoint"]
 description = Uncover activity consistent with credential dumping, a technique wherein attackers compromise systems and attempt to obtain and exfiltrate passwords. The threat actors use these pilfered credentials to further escalate privileges and spread throughout a target environment. The included searches in this Analytic Story are designed to identify attmpts to dump credentials.
 narrative = Credential dumping&#151;gathering credentials from a target system, often hashed or encrypted&#151;is a common attack technique. Even though the credentials may not be in plain text, an attacker can still exfiltrate the data and set to cracking it offline, on their own systems. The threat actors target a variety of sources to extract them, including the Security Accounts Manager (SAM), Local Security Authority (LSA), NTDS from Domain Controllers, or the Group Policy Preference (GPP) files.\
 \
@@ -271,9 +285,10 @@ id = 0c016e5c-88be-4e2c-8c6c-c2b55b4fb4ef
 version = 2.0
 reference = ["https://www.us-cert.gov/ncas/alerts/TA18-074A"]
 detection_searches = ["ESCU - SMB Traffic Spike - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Suspicious Reg.exe Process - Rule", "ESCU - Sc.exe Manipulating Windows Services - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Create local admin accounts using net.exe - Rule", "ESCU - Single Letter Process On Endpoint - Rule", "ESCU - Scheduled Task Name Used by Dragonfly Threat Actors - Rule", "ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Detect New Local Admin account - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - First time seen command line argument - Rule"]
-investigative_searches = ["ESCU - Get Backup Logs For Endpoint", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Get Parent Process Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Investigate Web Activity From Host", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Outbound Emails to Hidden Cobra Threat Actors", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Investigate Web Activity From Host"]
-support_searches = ["ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes", "ESCU - Previously Seen Running Windows Services", "ESCU - Previously seen command line arguments", "ESCU - Previously seen command line arguments", "ESCU - Previously seen command line arguments", "ESCU - Previously seen command line arguments", "ESCU - Previously seen command line arguments", "ESCU - Previously seen command line arguments", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes", "ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Previously seen command line arguments"]
-data_models = [[u'Network_Traffic'], [u'Endpoint'], [u'Endpoint'], [u'Endpoint'], [u'Endpoint'], [u'Endpoint'], [u'Endpoint'], [u'Endpoint'], [u'Endpoint'], [u'Network_Traffic'], [u'Endpoint'], [u'Endpoint']]
+mappings = {"mitre_attack": ["Defense Evasion", "Modify Registry", "Disabling Security Tools"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.CM"]}
+investigative_searches = ["Get Authentication Logs For Endpoint", "Get Notable History", "Get Notable Info", "Get Parent Process Info", "Get Process Info", "Get Risk Modifiers For Endpoint", "Get Risk Modifiers For User", "Get User Information from Identity Table"]
+support_searches = ["Previously seen command line arguments"]
+data_models = ["Endpoint", "Network_Traffic"]
 description = Monitor for suspicious activities associated with DHS Technical Alert US-CERT TA18-074A. Some of the activities that adversaries used in these compromises included spearfishing attacks, malware, watering-hole domains, many and more.
 narrative = The frequency of nation-state cyber attacks has increased significantly over the last decade. Employing numerous tactics and techniques, these attacks continue to escalate in complexity. \
 \
@@ -291,9 +306,10 @@ id = e8afd39e-3294-11e6-b39d-a45e60c6700
 version = 1.0
 reference = ["https://www.us-cert.gov/ncas/alerts/TA13-088A", "https://deepthought.isc.org/article/AA-00897/0/What-is-a-DNS-Amplification-Attack.html"]
 detection_searches = ["ESCU - Large Volume of DNS ANY Queries - Rule"]
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint"]
+mappings = {"cis20": ["CIS 11", "CIS 12"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.PT", "DE.AE", "PR.IP"]}
+investigative_searches = ["Get Notable History", "Get Notable Info", "Get Risk Modifiers For Endpoint", "Get Risk Modifiers For User"]
 support_searches = []
-data_models = [[u'Network_Resolution']]
+data_models = ["Network_Resolution"]
 description = DNS poses a serious threat as a Denial of Service (DOS) amplifier, if it responds to `ANY` queries. This Analytic Story can help you detect attackers who may be abusing your company's DNS infrastructure to launch amplification attacks, causing Denial of Service to other victims.
 narrative = The Domain Name System (DNS) is the protocol used to map domain names to IP addresses. It has been proven to work very well for its intended function. However if DNS is misconfigured, servers can be abused by attackers to levy amplification or redirection attacks against victims. Because DNS responses to `ANY` queries are so much larger than the queries themselves--and can be made with a UDP packet, which does not require a handshake--attackers can spoof the source address of the packet and cause much more data to be sent to the victim than if they sent the traffic themselves. The `ANY` requests are will be larger than normal DNS server requests, due to the fact that the server provides significant details, such as MX records and associated IP addresses. A large volume of this traffic can result in a DOS on the victim's machine. This misconfiguration leads to two possible victims, the first being the DNS servers participating in an attack and the other being the hosts that are the targets of the DOS attack.\
 \
@@ -307,9 +323,10 @@ id = 8169f17b-ef68-4b59-aa28-586907301221
 version = 1.0
 reference = ["https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html", "https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/", "http://www.noip.com/blog/2014/07/11/dynamic-dns-can-use-2/", "https://www.splunk.com/blog/2015/08/04/detecting-dynamic-dns-domains-in-splunk.html"]
 detection_searches = ["ESCU - DNS record changed - Rule", "ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule"]
-investigative_searches = ["ESCU - Get DNS Server History for a host", "ESCU - Get DNS Server History for a host", "ESCU - Get DNS Server History for a host", "ESCU - Get DNS Server History for a host"]
-support_searches = ["ESCU - Discover DNS records"]
-data_models = [[u'Network_Resolution'], [u'Network_Resolution'], [u'Network_Resolution'], [u'Network_Resolution']]
+mappings = {"mitre_attack": ["Exfiltration", "Exfiltration Over Command and Control Channel", "Defense Evasion", "Commonly Used Port"], "cis20": ["CIS 8", "CIS 12", "CIS 13"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "nist": ["PR.DS", "PR.PT", "DE.AE", "DE.CM"]}
+investigative_searches = []
+support_searches = ["Discover DNS records"]
+data_models = ["Network_Resolution"]
 description = Secure your environment against DNS hijacks with searches that help you detect and investigate unauthorized changes to DNS records.
 narrative = Dubbed the Achilles heel of the Internet (see https://www.f5.com/labs/articles/threat-intelligence/dns-is-still-the-achilles-heel-of-the-internet-25613), DNS plays a critical role in routing web traffic but is notoriously vulnerable to attack. One reason is its distributed nature. It relies on unstructured connections between millions of clients and servers over inherently insecure protocols.\
 \
@@ -337,9 +354,10 @@ id = 91c676cf-0b23-438d-abee-f6335e1fce33
 version = 1.0
 reference = ["https://www.cisecurity.org/controls/data-protection/", "https://www.sans.org/reading-room/whitepapers/dns/splunk-detect-dns-tunneling-37022", "https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/"]
 detection_searches = ["ESCU - Detection of DNS Tunnels - Rule", "ESCU - Detect USB device insertion - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule"]
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get DNS Server History for a host", "ESCU - Get DNS traffic ratio", "ESCU - Get Process responsible for the DNS traffic", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get DNS Server History for a host", "ESCU - Get Process responsible for the DNS traffic", "ESCU - Get DNS Server History for a host"]
+mappings = {"mitre_attack": ["Command and Control", "Exfiltration", "Commonly Used Port"], "cis20": ["CIS 13"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "nist": ["PR.PT", "PR.DS"]}
+investigative_searches = ["Get Authentication Logs For Endpoint", "Get DNS Server History for a host", "Get Notable History", "Get Notable Info", "Get Process responsible for the DNS traffic", "Get Risk Modifiers For Endpoint", "Get Risk Modifiers For User", "Get User Information from Identity Table"]
 support_searches = []
-data_models = [[u'Network_Resolution'], [u'Change_Analysis'], [u'Network_Resolution']]
+data_models = ["Change_Analysis", "Network_Resolution"]
 description = Fortify your data-protection arsenal--while continuing to ensure data confidentiality and integrity--with searches that monitor for and help you investigate possible signs of data exfiltration.
 narrative = Attackers can leverage a variety of resources to compromise or exfiltrate enterprise data. Common exfiltration techniques include remote-access channels via low-risk, high-payoff active-collections operations and close-access operations using insiders and removable media. While this Analytic Story is not a comprehensive listing of all the methods by which attackers can exfiltrate data, it provides a useful starting point.
 
@@ -351,9 +369,10 @@ id = fcc27099-46a0-46b0-a271-5c7dab56b6f1
 version = 1.0
 reference = ["https://attack.mitre.org/wiki/Technique/T1089", "https://blog.malwarebytes.com/cybercrime/2015/11/vonteera-adware-uses-certificates-to-disable-anti-malware/", "https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Tools-Report.pdf"]
 detection_searches = ["ESCU - Sc.exe Manipulating Windows Services - Rule", "ESCU - Suspicious Reg.exe Process - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Attempt To Stop Security Service - Rule", "ESCU - Attempt To Add Certificate To Untrusted Store - Rule"]
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Investigate Web Activity From Host", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info"]
-support_searches = ["ESCU - Previously Seen Running Windows Services"]
-data_models = [[u'Endpoint'], [u'Endpoint'], [u'Endpoint'], [u'Endpoint'], [u'Endpoint']]
+mappings = {"mitre_attack": ["Defense Evasion", "Modify Registry", "Disabling Security Tools"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.CM"]}
+investigative_searches = ["Get Authentication Logs For Endpoint", "Get Notable History", "Get Notable Info", "Get Parent Process Info", "Get Process Info", "Get Risk Modifiers For Endpoint", "Get Risk Modifiers For User", "Get User Information from Identity Table"]
+support_searches = []
+data_models = ["Endpoint"]
 description = Looks for activities and techniques associated with the disabling of security tools on a Windows system, such as suspicious `reg.exe` processes, processes launching netsh, and many others.
 narrative = Attackers employ a variety of tactics in order to avoid detection and operate without barriers. This often involves modifying the configuration of security tools to get around them or explicitly disabling them to prevent them from running. This Analytic Story includes searches that look for activity consistent with attackers attempting to disable various security mechanisms. Such activity may involve monitoring for suspicious registry activity, as this is where much of the configuration for Windows and various other programs reside, or explicitly attempting to shut down security-related services. Other times, attackers attempt various tricks to prevent specific programs from running, such as adding the certificates with which the security tools are signed to a blacklist (which would prevent them from running).
 
@@ -365,9 +384,10 @@ id = 8169f17b-ef68-4b59-aae8-5869073014e1
 version = 2.0
 reference = ["https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html", "https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/", "http://www.noip.com/blog/2014/07/11/dynamic-dns-can-use-2/", "https://www.splunk.com/blog/2015/08/04/detecting-dynamic-dns-domains-in-splunk.html"]
 detection_searches = ["ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detect web traffic to dynamic domain providers - Rule"]
-investigative_searches = ["ESCU - Get DNS Server History for a host", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get DNS Server History for a host", "ESCU - Get DNS traffic ratio", "ESCU - Get Process responsible for the DNS traffic", "ESCU - Investigate Web Activity From src_ip"]
+mappings = {"mitre_attack": ["Command and Control", "Web Service", "Exfiltration Over Command and Control Channel", "Defense Evasion"], "cis20": ["CIS 7", "CIS 8"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "nist": ["PR.IP", "DE.DP"]}
+investigative_searches = ["Get Authentication Logs For Endpoint", "Get DNS Server History for a host", "Get DNS traffic ratio", "Get Notable History", "Get Notable Info", "Get Process responsible for the DNS traffic", "Get Risk Modifiers For Endpoint", "Get Risk Modifiers For User", "Get User Information from Identity Table", "Investigate Web Activity From src_ip"]
 support_searches = []
-data_models = [[u'Network_Resolution'], [u'Web']]
+data_models = ["Network_Resolution", "Web"]
 description = Detect and investigate hosts in your environment that may be communicating with dynamic domain providers. Attackers may leverage these services to help them avoid firewall blocks and blacklists.
 narrative = Dynamic DNS services (DDNS) are legitimate low-cost or free services that allow users to rapidly update domain resolutions to IP infrastructure. While their usage can be benign, malicious actors can abuse DDNS to host harmful payloads or interactive-command-and-control infrastructure. These attackers will manually update or automate domain resolution changes by routing dynamic domains to IP addresses that circumvent firewall blocks and blacklists and frustrate a network defender's analytic and investigative processes. These searches will look for DNS queries made from within your infrastructure to suspicious dynamic domains and then investigate more deeply, when appropriate. While this list of top-level dynamic domains is not exhaustive, it can be dynamically updated as new suspicious dynamic domains are identified.
 
@@ -379,9 +399,10 @@ id = bb9f5ed2-916e-4364-bb6d-91c310efcf52
 version = 1.0
 reference = ["https://www.us-cert.gov/ncas/alerts/TA18-201A", "https://www.first.org/resources/papers/conf2017/Advanced-Incident-Detection-and-Threat-Hunting-using-Sysmon-and-Splunk.pdf", "https://www.vkremez.com/2017/05/emotet-banking-trojan-malware-analysis.html"]
 detection_searches = ["ESCU - Detect Rare Executables - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Detect Use of cmd.exe to Launch Script Interpreters - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule", "ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Detection of tools built by NirSoft - Rule"]
-investigative_searches = ["ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Investigate Web Activity From Host", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Investigate Web Activity From Host", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Get Parent Process Info", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Get Parent Process Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Email Info", "ESCU - Get Emails From Specific Sender", "ESCU - Investigate Web Activity From Host", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Email Info", "ESCU - Get Emails From Specific Sender", "ESCU - Investigate Web Activity From Host", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Investigate Web Activity From Host"]
-support_searches = ["ESCU - Previously seen command line arguments", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes", "ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes"]
-data_models = [[u'Endpoint'], [u'Endpoint'], [u'Endpoint'], [u'Endpoint'], [u'Network_Traffic'], [u'Email'], [u'Email'], [u'Endpoint']]
+mappings = {"mitre_attack": ["Execution", "Defense Evasion"], "cis20": ["CIS 3", "CIS 7", "CIS 12"], "kill_chain_phases": ["Delivery"], "nist": ["DE.AE", "PR.IP"]}
+investigative_searches = ["Get Authentication Logs For Endpoint", "Get Notable History", "Get Notable Info", "Get Parent Process Info", "Get Process Info", "Get Risk Modifiers For Endpoint", "Get Risk Modifiers For User", "Get User Information from Identity Table", "Investigate Web Activity From Host"]
+support_searches = []
+data_models = ["Email", "Endpoint", "Network_Traffic"]
 description = Detect rarely used executables, specific registry paths that may confer malware survivability and persistence, instances where cmd.exe is used to launch script interpreters, and other indicators that the Emotet financial malware has compromised your environment.
 narrative = The trojan downloader known as Emotet first surfaced in 2014, when it was discovered targeting the banking industry to steal credentials. However, according to a joint technical alert (TA) issued by three government agencies (https://www.us-cert.gov/ncas/alerts/TA18-201A), Emotet has evolved far beyond those beginnings to become what a ThreatPost article called a threat-delivery service(see https://threatpost.com/emotet-malware-evolves-beyond-banking-to-threat-delivery-service/134342/).  For example, in early 2018, Emotet was found to be using its loader function to spread the Quakbot and Ransomware variants. \
 \
@@ -397,9 +418,10 @@ id = baf7580b-d4b4-4774-8173-7d198e9da335
 version = 2.0
 reference = ["https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity", "https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf"]
 detection_searches = ["ESCU - SMB Traffic Spike - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - Create or delete hidden shares using net.exe - Rule", "ESCU - Suspicious File Write - Rule"]
-investigative_searches = ["ESCU - Get Backup Logs For Endpoint", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Investigate Web Activity From Host", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Outbound Emails to Hidden Cobra Threat Actors", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get DNS Server History for a host", "ESCU - Get DNS traffic ratio", "ESCU - Get Process responsible for the DNS traffic", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Outbound Emails to Hidden Cobra Threat Actors", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Outbound Emails to Hidden Cobra Threat Actors"]
-support_searches = ["ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes", "ESCU - Previously seen command line arguments", "ESCU - Previously seen command line arguments", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes", "ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Identify Systems Using Remote Desktop", "ESCU - Identify Systems Creating Remote Desktop Traffic", "ESCU - Identify Systems Receiving Remote Desktop Traffic", "ESCU - Previously seen command line arguments", "ESCU - Previously seen command line arguments"]
-data_models = [[u'Network_Traffic'], [u'Endpoint'], [u'Network_Traffic'], [u'Network_Traffic'], [u'Endpoint'], [u'Network_Resolution'], [u'Endpoint'], [u'Endpoint']]
+mappings = {"mitre_attack": [], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.PT", "DE.CM"]}
+investigative_searches = ["Get Authentication Logs For Endpoint", "Get Notable History", "Get Notable Info", "Get Outbound Emails to Hidden Cobra Threat Actors", "Get Parent Process Info", "Get Process Info", "Get Risk Modifiers For Endpoint", "Get Risk Modifiers For User", "Get User Information from Identity Table"]
+support_searches = ["Previously seen command line arguments"]
+data_models = ["Endpoint", "Network_Resolution", "Network_Traffic"]
 description = Monitor for and investigate activities, including the creation or deletion of hidden shares and file writes, that may be evidence of infiltration by North Korean government-sponsored cybercriminals. Details of this activity were reported in DHS Report TA-18-149A.
 narrative = North Korea's government-sponsored "cyber army" has been slowly building momentum and gaining sophistication over the last 15 years or so. As a result, the group's activity, which the US government refers to as "Hidden Cobra," has surreptitiously crept onto the collective radar as a preeminent global threat.\
 \
@@ -417,9 +439,10 @@ id = 2e8948a5-5239-406b-b56b-6c50fe268af4
 version = 1.0
 reference = ["https://blog.malwarebytes.com/cybercrime/2016/09/hosts-file-hijacks/"]
 detection_searches = ["ESCU - Windows hosts file modification - Rule"]
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Investigate Web Activity From Host", "ESCU - Get DNS Server History for a host", "ESCU - Get Process responsible for the DNS traffic"]
+mappings = {"mitre_attack": ["Command and Control", "Exfiltration"], "cis20": ["CIS 3", "CIS 8", "CIS 12"], "kill_chain_phases": ["Command and Control"], "nist": ["PR.IP", "PR.PT", "PR.AC", "DE.AE", "DE.CM"]}
+investigative_searches = ["Get Authentication Logs For Endpoint", "Get DNS Server History for a host", "Get Notable History", "Get Notable Info", "Get Process responsible for the DNS traffic", "Get Risk Modifiers For Endpoint", "Get Risk Modifiers For User", "Get User Information from Identity Table", "Investigate Web Activity From Host"]
 support_searches = []
-data_models = [[u'Endpoint']]
+data_models = ["Endpoint"]
 description = Detect evidence of tactics used to redirect traffic from a host to a destination other than the one intended--potentially one that is part of an adversary's attack infrastructure. An example is redirecting communications regarding patches and updates or misleading users into visiting a malicious website.
 narrative = Attackers will often attempt to manipulate client communications for nefarious purposes. In some cases, an attacker may endeavor to modify a local host file to redirect communications with resources (such as antivirus or system-update services) to prevent clients from receiving patches or updates. In other cases, an attacker might use this tactic to have the client connect to a site that looks like the intended site, but instead installs malware or collects information from the victim. Additionally, an attacker may redirect a victim in order to execute a MITM attack and observe communications.
 
@@ -431,9 +454,10 @@ id = 1f5294cb-b85f-4c2d-9c58-ffcf248f52bd
 version = 1.0
 reference = ["http://www.deependresearch.org/2016/04/jboss-exploits-view-from-victim.html"]
 detection_searches = ["ESCU - Detect malicious requests to exploit JBoss servers - Rule", "ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule"]
-investigative_searches = ["ESCU - Get Backup Logs For Endpoint", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Get Parent Process Info", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Get Parent Process Info"]
-support_searches = ["ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes", "ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes", "ESCU - Add Prohibited Processes to Enterprise Security"]
-data_models = [[u'Web'], [u'Web']]
+mappings = {"mitre_attack": ["Defense Evasion", "Exploitation of Vulnerability"], "cis20": ["CIS 12", "CIS 4", "CIS 18"], "kill_chain_phases": ["Delivery"], "nist": ["ID.RA", "PR.PT", "PR.IP", "DE.AE", "PR.MA", "DE.CM"]}
+investigative_searches = ["Get Authentication Logs For Endpoint", "Get Notable History", "Get Notable Info", "Get Risk Modifiers For Endpoint", "Get Risk Modifiers For User", "Get User Information from Identity Table"]
+support_searches = []
+data_models = ["Web"]
 description = In March of 2016, adversaries were seen using JexBoss--an open-source utility used for testing and exploiting JBoss application servers. These searches help detect evidence of these attacks, such as network connections to external resources or web services spawning atypical child processes, among others.
 narrative = This Analytic Story looks for probing and exploitation attempts targeting JBoss application servers. While the vulnerabilities associated with this story are rather dated, they were leveraged in a spring 2016 campaign in connection with the Samsam ransomware variant. Incidents involving this ransomware are unique, in that they begin with attacks against vulnerable services, rather than the phishing or drive-by attacks more common with ransomware. In this case, vulnerable JBoss applications appear to be the target of choice.\
 \
@@ -473,9 +497,10 @@ id = 399d65dc-1f08-499b-a259-aad9051f38ad
 version = 1.0
 reference = ["https://www.binarydefense.com/bds/reliably-detecting-pass-the-hash-through-event-log-analysis/", "https://www.fireeye.com/blog/executive-perspective/2015/08/malware_lateral_move.html"]
 detection_searches = ["ESCU - Schtasks scheduling job on remote system - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Detect Activity Related to Pass the Hash Attacks - Rule", "ESCU - Remote Registry Key modifications - Rule"]
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info"]
-support_searches = ["ESCU - Identify Systems Using Remote Desktop", "ESCU - Identify Systems Creating Remote Desktop Traffic", "ESCU - Identify Systems Receiving Remote Desktop Traffic", "ESCU - Identify Systems Using Remote Desktop", "ESCU - Identify Systems Creating Remote Desktop Traffic", "ESCU - Identify Systems Receiving Remote Desktop Traffic", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes", "ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Identify Systems Using Remote Desktop", "ESCU - Identify Systems Creating Remote Desktop Traffic", "ESCU - Identify Systems Receiving Remote Desktop Traffic"]
-data_models = [[u'Endpoint'], [u'Endpoint'], [u'Network_Traffic'], [u'Endpoint']]
+mappings = {"mitre_attack": ["Persistence", "Lateral Movement", "Execution", "Scheduled Task", "Remote Services"], "cis20": ["CIS 3"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.IP"]}
+investigative_searches = ["Get Authentication Logs For Endpoint", "Get Notable History", "Get Notable Info", "Get Process Info", "Get Risk Modifiers For Endpoint", "Get Risk Modifiers For User", "Get User Information from Identity Table"]
+support_searches = ["Identify Systems Creating Remote Desktop Traffic", "Identify Systems Receiving Remote Desktop Traffic", "Identify Systems Using Remote Desktop"]
+data_models = ["Endpoint", "Network_Traffic"]
 description = Detect and investigate tactics, techniques, and procedures around how attackers move laterally within the enterprise. Because lateral movement can expose the adversary to detection, it should be an important focus for security analysts.
 narrative = Once attackers gain a foothold within an enterprise, they will seek to expand their accesses and leverage techniques that facilitate lateral movement. Attackers will often spend quite a bit of time and effort moving laterally. Because lateral movement renders an attacker the most vulnerable to detection, it's an excellent focus for detection and investigation.\
 \
@@ -495,9 +520,10 @@ id = 2c8ff66e-0b57-42af-8ad7-912438a403fc
 version = 4.0
 reference = ["https://blogs.mcafee.com/mcafee-labs/malware-employs-powershell-to-infect-systems/", "https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"]
 detection_searches = ["ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments - Rule", "ESCU - Malicious PowerShell Process With Obfuscation Techniques - Rule", "ESCU - Attempt To Set Default PowerShell Execution Policy To Unrestricted - Rule"]
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info"]
-support_searches = ["ESCU - Previously seen command line arguments"]
-data_models = [[u'Endpoint'], [u'Endpoint'], [u'Endpoint'], [u'Endpoint'], [u'Endpoint']]
+mappings = {"mitre_attack": ["Execution", "PowerShell", "Scripting"], "cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "nist": ["PR.PT", "DE.CM", "PR.IP"]}
+investigative_searches = ["Get Authentication Logs For Endpoint", "Get Notable History", "Get Notable Info", "Get Process Info", "Get Risk Modifiers For Endpoint", "Get Risk Modifiers For User", "Get User Information from Identity Table"]
+support_searches = []
+data_models = ["Endpoint"]
 description = Attackers are finding stealthy ways "live off the land," leveraging utilities and tools that come standard on the endpoint--such as PowerShell--to achieve their goals without downloading binary files. These searches can help you detect and investigate PowerShell command-line options that may be indicative of malicious intent.
 narrative = The searches in this Analytic Story monitor for parameters often used for malicious purposes. It is helpful to understand how often the notable events generated by this story occur, as well as the commonalities between some of these events. These factors may provide clues about whether this is a common occurrence of minimal concern or a rare event that may require more extensive investigation. Likewise, it is important to determine whether the issue is restricted to a single user/system or is broader in scope.\
 \
@@ -527,8 +553,9 @@ id = abe807c7-1eb6-4304-ac32-6e7aacdb891d
 version = 1.0
 reference = ["https://www.carbonblack.com/2016/03/04/tracking-locky-ransomware-using-carbon-black/"]
 detection_searches = ["ESCU - Unsuccessful Netbackup backups - Rule", "ESCU - Extended Period Without Successful Netbackup Backups - Rule"]
-investigative_searches = ["ESCU - Get Notable History", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - All backup logs for host", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - All backup logs for host"]
-support_searches = ["ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups"]
+mappings = {"cis20": ["CIS 10"], "nist": ["PR.IP"]}
+investigative_searches = ["All backup logs for host", "Get Notable History", "Get Risk Modifiers For Endpoint", "Get Risk Modifiers For User"]
+support_searches = ["Monitor Successful Backups", "Monitor Unsuccessful Backups"]
 data_models = []
 description = Address common concerns when monitoring your backup processes. These searches can help you reduce risks from ransomware, device theft, or denial of physical access to a host by backing up data on endpoints.
 narrative = Having backups is a standard best practice that helps ensure continuity of business operations.  Having mature backup processes can also help you reduce the risks of many security-related incidents and streamline your response processes. The detection searches in this Analytic Story will help you identify systems that have backup failures, as well as systems that have not been backed up for an extended period of time. The story will also return the notable event history and all of the backup logs for an endpoint.
@@ -541,9 +568,10 @@ id = 8892a655-6205-43f7-abba-06460e38c8ae
 version = 1.0
 reference = ["https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"]
 detection_searches = ["ESCU - Prohibited Software On Endpoint - Rule"]
-investigative_searches = ["ESCU - Get Backup Logs For Endpoint", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Get Parent Process Info"]
-support_searches = ["ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes", "ESCU - Add Prohibited Processes to Enterprise Security"]
-data_models = [[u'Endpoint']]
+mappings = {"mitre_attack": ["Execution"], "cis20": ["CIS 2"], "kill_chain_phases": ["Installation", "Command and Control", "Actions on Objectives"], "nist": ["ID.AM", "PR.DS"]}
+investigative_searches = ["Get Authentication Logs For Endpoint", "Get Notable History", "Get Process Info", "Get Risk Modifiers For Endpoint", "Get Risk Modifiers For User", "Get User Information from Identity Table", "Investigate Web Activity From Host"]
+support_searches = ["Add Prohibited Processes to Enterprise Security"]
+data_models = ["Endpoint"]
 description = Identify and investigate prohibited/unauthorized software or processes that may be concealing malicious behavior within your environment.
 narrative = It is critical to identify unauthorized software and processes running on enterprise endpoints and determine whether they are likely to be malicious. This Analytic Story requires the user to populate the Interesting Processes table within Enterprise Security with prohibited processes. An included support search will augment this data, adding information on processes thought to be malicious. This search requires data from endpoint detection-and-response solutions, endpoint data sources (such as Sysmon), or Windows Event Logs--assuming that the Active Directory administrator has enabled process tracking within the System Event Audit Logs.\
 \
@@ -557,9 +585,10 @@ id = 9ef8d677-7b52-4213-a038-99cfc7acc2d8
 version = 1.0
 reference = ["https://learn.cisecurity.org/20-controls-download"]
 detection_searches = ["ESCU - No Windows Updates in a time frame - Rule"]
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint"]
+mappings = {"cis20": ["CIS 18"], "nist": ["PR.PT", "PR.MA"]}
+investigative_searches = ["Get Authentication Logs For Endpoint", "Get Notable History", "Get Notable Info", "Get Risk Modifiers For Endpoint", "Get Risk Modifiers For User", "Get User Information from Identity Table"]
 support_searches = []
-data_models = [[u'Updates']]
+data_models = ["Updates"]
 description = Monitor your enterprise to ensure that your endpoints are being patched and updated. Adversaries notoriously exploit known vulnerabilities that could be mitigated by applying routine security patches.
 narrative = It is a common best practice to ensure that endpoints are being patched and updated in a timely manner, in order to reduce the risk of compromise via a publicly disclosed vulnerability. Timely application of updates/patches is important to eliminate known vulnerabilities that may be exploited by various threat actors.\
 \
@@ -575,9 +604,10 @@ id = 2b1800dd-92f9-47ec-a981-fdf1351e5f65
 version = 1.0
 reference = ["https://technet.microsoft.com/library/bb490939.aspx", "https://htmlpreview.github.io/?https://github.com/MatthewDemaske/blogbackup/blob/master/netshell.html", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html"]
 detection_searches = ["ESCU - Processes created by netsh - Rule", "ESCU - Processes launching netsh - Rule"]
-investigative_searches = ["ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Investigate Web Activity From Host", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Investigate Web Activity From Host"]
+mappings = {"mitre_attack": ["Execution", "Command-Line Interface", "Persistence", "Defense Evasion", "Disabling Security Tools"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.PT", "DE.CM"]}
+investigative_searches = ["Get Authentication Logs For Endpoint", "Get Notable History", "Get Parent Process Info", "Get Process Info", "Get Risk Modifiers For Endpoint", "Get Risk Modifiers For User", "Get User Information from Identity Table", "Investigate Web Activity From Host"]
 support_searches = []
-data_models = [[u'Endpoint'], [u'Endpoint']]
+data_models = ["Endpoint"]
 description = Detect activities and various techniques associated with the abuse of `netsh.exe`, which can disable local firewall settings or set up a remote connection to a host from an infected system.
 narrative = It is a common practice for attackers of all types to leverage native Windows tools and functionality to execute commands for malicious reasons. One such tool on Windows OS is `netsh.exe`,a command-line scripting utility that allows you to--either locally or remotely--display or modify the network configuration of a computer that is currently running. `Netsh.exe` can be used to discover and disable local firewall settings. It can also be used to set up a remote connection to a host from an infected system.\
 \
@@ -591,9 +621,10 @@ id = bb9f5ed2-916e-4364-bb6d-97c370efcf52
 version = 2.0
 reference = ["https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia", "https://www.infosecurity-magazine.com/news/healthcare-targeted-by-hacker/"]
 detection_searches = ["ESCU - First time seen command line argument - Rule", "ESCU - Sc.exe Manipulating Windows Services - Rule", "ESCU - First Time Seen Running Windows Service - Rule"]
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Investigate Web Activity From Host", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info"]
-support_searches = ["ESCU - Previously seen command line arguments", "ESCU - Previously Seen Running Windows Services", "ESCU - Previously Seen Running Windows Services"]
-data_models = [[u'Endpoint'], [u'Endpoint']]
+mappings = {"mitre_attack": ["Persistence", "Privilege Escalation", "New Service", "Modify Existing Service", "Defense Evasion", "Disabling Security Tools"], "cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Installation"], "nist": ["PR.IP", "PR.PT", "PR.AC", "PR.AT", "DE.CM"]}
+investigative_searches = ["Get Authentication Logs For Endpoint", "Get Notable History", "Get Notable Info", "Get Parent Process Info", "Get Process Info", "Get Risk Modifiers For Endpoint", "Get Risk Modifiers For User", "Get User Information from Identity Table", "Investigate Web Activity From Host"]
+support_searches = ["Previously Seen Running Windows Services", "Previously seen command line arguments"]
+data_models = ["Endpoint"]
 description = Detect activities and various techniques associated with the Orangeworm Attack Group, a group that frequently targets the healthcare industry.
 narrative = In May of 2018, the attack group Orangeworm was implicated for installing a custom backdoor called Trojan.Kwampirs within large international healthcare corporations in the United States, Europe, and Asia. This malware provides the attackers with remote access to the target system, decrypting and extracting a copy of its main DLL payload from its resource section. Before writing the payload to disk, it inserts a randomly generated string into the middle of the decrypted payload in an attempt to evade hash-based detections.\
 \
@@ -613,9 +644,10 @@ id = 57226b40-94f3-4ce5-b101-a75f67759c27
 version = 1.0
 reference = []
 detection_searches = ["ESCU - Detect Oulook.exe writing a .zip file - Rule", "ESCU - Suspicious LNK file launching a process - Rule"]
+mappings = {"mitre_attack": ["Spearphishing Attachment"], "cis20": ["CIS 7", "CIS 8"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "nist": ["ID.AM", "PR.DS"]}
 investigative_searches = []
 support_searches = []
-data_models = [[u'Endpoint'], [u'Endpoint']]
+data_models = ["Endpoint"]
 description = XXXX - Placeholder for Phishing description
 narrative = XXXX - Placeholder for Phishing narrative
 
@@ -627,9 +659,10 @@ id = 988C59C5-0A1C-45B6-A555-0C62276E327E
 version = 1.0
 reference = ["https://intelgraph.idefense.com/#/node/threat_group/view/29fbec10-8cc8-4662-8362-2c24c1eeb74c", "https://intelgraph.idefense.com/#/node/intelligence_alert/view/62bb3669-9386-4264-b51a-59876cf50ffe", "http://blog.amossys.fr/badflick-is-not-so-bad.html"]
 detection_searches = ["ESCU - First time seen command line argument - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Unusually Long Command Line - Rule"]
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Investigate Web Activity From Host", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Investigate Web Activity From Host"]
-support_searches = ["ESCU - Previously seen command line arguments", "ESCU - Previously seen command line arguments"]
-data_models = [[u'Endpoint'], [u'Endpoint'], [u'Endpoint'], [u'Endpoint']]
+mappings = {"mitre_attack": ["Execution"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.PT", "DE.CM"]}
+investigative_searches = ["Get Authentication Logs For Endpoint", "Get Notable History", "Get Notable Info", "Get Parent Process Info", "Get Process Info", "Get Risk Modifiers For Endpoint", "Get Risk Modifiers For User", "Get User Information from Identity Table"]
+support_searches = ["Previously seen command line arguments"]
+data_models = ["Endpoint"]
 description = Monitor your environment for suspicious behaviors that resemble the techniques employed by the MUDCARP threat group.
 narrative = This story was created as a joint effort between iDefense and Splunk.\
 \
@@ -695,9 +728,10 @@ id = 6d13121c-90f3-446d-8ac3-27efbbc65218
 version = 1.0
 reference = ["http://www.novetta.com/2015/02/advanced-methods-to-detect-advanced-cyber-attacks-protocol-abuse/"]
 detection_searches = ["ESCU - TOR Traffic - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule"]
-investigative_searches = ["ESCU - Get Backup Logs For Endpoint", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Get Parent Process Info", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Get Parent Process Info", "ESCU - Get Notable History", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Information For Port Activity", "ESCU - Get DNS Server History for a host"]
-support_searches = ["ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes", "ESCU - Count of Unique IPs Connecting to Ports"]
-data_models = [[u'Network_Traffic'], [u'Network_Traffic'], [u'Network_Traffic'], [u'Network_Resolution']]
+mappings = {"mitre_attack": ["Command and Control", "Commonly Used Port", "Exfiltration"], "cis20": ["CIS 9", "CIS 12"], "kill_chain_phases": ["Command and Control"], "nist": ["DE.AE"]}
+investigative_searches = ["Get Authentication Logs For Endpoint", "Get Notable History", "Get Process Information For Port Activity", "Get Risk Modifiers For Endpoint", "Get Risk Modifiers For User"]
+support_searches = ["Count of Unique IPs Connecting to Ports"]
+data_models = ["Network_Resolution", "Network_Traffic"]
 description = Detect instances of prohibited network traffic allowed in the environment, as well as protocols running on non-standard ports. Both of these types of behaviors typically violate policy and can be leveraged by attackers.
 narrative = A traditional security best practice is to control the ports, protocols, and services allowed within your environment. By limiting the services and protocols to those explicitly approved by policy, administrators can minimize the attack surface. The combined effect allows both network defenders and security controls to focus and not be mired in superfluous traffic or data types. Looking for deviations to policy can identify attacker activity that abuses services and protocols to run on alternate or non-standard ports in the attempt to avoid detection or frustrate forensic analysts.
 
@@ -709,9 +743,10 @@ id = cf309d0d-d4aa-4fbb-963d-1e79febd3756
 version = 1.0
 reference = ["https://www.symantec.com/connect/blogs/what-you-need-know-about-wannacry-ransomware", "https://www.carbonblack.com/2017/06/28/carbon-black-threat-research-technical-analysis-petya-notpetya-ransomware/", "https://www.splunk.com/blog/2017/06/27/closing-the-detection-to-mitigation-gap-or-to-petya-or-notpetya-whocares-.html"]
 detection_searches = ["ESCU - Windows Event Log Cleared - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - Schtasks used for forcing a reboot - Rule"]
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Get Parent Process Info", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Get Parent Process Info", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Get Parent Process Info", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Get Parent Process Info", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Get Parent Process Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Investigate Web Activity From Host", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Sysmon WMI Activity for Host", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Investigate Web Activity From Host", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info"]
-support_searches = ["ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes", "ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes", "ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes", "ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes"]
-data_models = [[u'Endpoint'], [u'Endpoint'], [u'Endpoint'], [u'Endpoint'], [u'Network_Traffic'], [u'Network_Traffic'], [u'Endpoint'], [u'Endpoint'], [u'Endpoint'], [u'Endpoint'], [u'Network_Traffic'], [u'Endpoint'], [u'Endpoint'], [u'Endpoint'], [u'Endpoint']]
+mappings = {"mitre_attack": ["Defense Evasion", "Indicator Removal on Host"], "cis20": ["CIS 3", "CIS 5", "CIS 6"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.DP", "PR.IP", "PR.AC", "PR.AT", "DE.AE"]}
+investigative_searches = ["Get Authentication Logs For Endpoint", "Get Backup Logs For Endpoint", "Get Notable History", "Get Parent Process Info", "Get Process Info", "Get Process Information For Port Activity", "Get Risk Modifiers For Endpoint", "Get Risk Modifiers For User", "Get Update Logs For Endpoint", "Get User Information from Identity Table", "Get Vulnerability Logs For Endpoint", "Investigate Web Activity From Host"]
+support_searches = ["Monitor Successful Backups", "Monitor Unsuccessful Backups", "Windows Updates Install Failures", "Windows Updates Install Successes"]
+data_models = ["Endpoint", "Network_Traffic"]
 description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware--spikes in SMB traffic, suspicious wevtutil usage, the presence of common ransomware extensions, and system processes run from unexpected locations, and many others.
 narrative = Ransomware is an ever-present risk to the enterprise, wherein an infected host encrypts business-critical data, holding it hostage until the victim pays the attacker a ransom. There are many types and varieties of ransomware that can affect an enterprise. Attackers can deploy ransomware to enterprises through spearphishing campaigns and driveby downloads, as well as through traditional remote service-based exploitation. In the case of the WannaCry campaign, there was self-propagating wormable functionality that was used to maximize infection. Fortunately, organizations can apply several techniques--such as those in this Analytic Story--to detect and or mitigate the effects of ransomware.
 
@@ -723,9 +758,10 @@ id = 91c676cf-0b23-438d-abee-f6335e177e77
 version = 1.0
 reference = ["https://www.fireeye.com/blog/executive-perspective/2015/09/the_new_route_toper.html", "https://www.cisco.com/c/en/us/about/security-center/event-response/synful-knock.html"]
 detection_searches = ["ESCU - Detect New Login Attempts to Routers - Rule"]
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint"]
+mappings = {"cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.PT", "PR.AC", "PR.IP"]}
+investigative_searches = ["Get Authentication Logs For Endpoint", "Get Notable History", "Get Notable Info", "Get Risk Modifiers For Endpoint", "Get Risk Modifiers For User", "Get User Information from Identity Table"]
 support_searches = []
-data_models = [[u'Authentication']]
+data_models = ["Authentication"]
 description = Validate the security configuration of network infrastructure and verify that only authorized users and systems are accessing critical assets. Core routing and switching infrastructure are common strategic targets for attackers.
 narrative = Networking devices, such as routers and switches, are often overlooked as resources that attackers will leverage to subvert an enterprise. Advanced threats actors have shown a proclivity to target these critical assets as a means to siphon and redirect network traffic, flash backdoored operating systems, and implement cryptographic weakened algorithms to more easily decrypt network traffic.\
 \
@@ -739,9 +775,10 @@ id = 4f6632f5-449c-4686-80df-57625f59bab3
 version = 1.0
 reference = ["https://www.owasp.org/index.php/SQL_Injection", "https://www.owasp.org/index.php/Blind_SQL_Injection", "https://www.incapsula.com/web-application-security/sql-injection.html"]
 detection_searches = ["ESCU - SQL Injection with Long URLs - Rule"]
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint"]
+mappings = {"mitre_attack": ["Defense Evasion", "Exploitation of Vulnerability", "Execution", "Commonly Used Port"], "cis20": ["CIS 4", "CIS 13", "CIS 18"], "kill_chain_phases": ["Delivery"], "nist": ["PR.DS", "ID.RA", "PR.PT", "PR.IP", "DE.CM"]}
+investigative_searches = ["Get Authentication Logs For Endpoint", "Get Notable History", "Get Notable Info", "Get Risk Modifiers For Endpoint", "Get Risk Modifiers For User", "Get User Information from Identity Table"]
 support_searches = []
-data_models = [[u'Web']]
+data_models = ["Web"]
 description = Use the searches in this Analytic Story to help you detect structured query language (SQL) injection attempts characterized by long URLs that contain malicious parameters.
 narrative = It is very common for attackers to inject SQL parameters into vulnerable web applications, which then interpret the malicious SQL statements.\
 \
@@ -755,9 +792,10 @@ id = c4b89506-fbcf-4cb7-bfd6-527e54789604
 version = 1.0
 reference = ["https://www.crowdstrike.com/blog/an-in-depth-analysis-of-samsam-ransomware-and-boss-spider/", "https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/SamSam-ransomware-chooses-Its-targets-carefully-wpna.pdf", "https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/SamSam-The-Almost-Six-Million-Dollar-Ransomware.pdf?cmp=26061"]
 detection_searches = ["ESCU - Deleting Shadow Copies - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule", "ESCU - Detect malicious requests to exploit JBoss servers - Rule", "ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - File with Samsam Extension - Rule", "ESCU - Samsam Test File Write - Rule", "ESCU - Batch File Write to System32 - Rule"]
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Get Parent Process Info", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Get Parent Process Info", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Get Parent Process Info", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Get Parent Process Info", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Get Parent Process Info", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Get Parent Process Info", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Get Parent Process Info", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Get Parent Process Info", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Get Parent Process Info", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Get Parent Process Info", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Get Parent Process Info", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Get Parent Process Info"]
-support_searches = ["ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes", "ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes", "ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes", "ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes", "ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes", "ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes", "ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes", "ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes", "ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes", "ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes", "ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes", "ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes", "ESCU - Add Prohibited Processes to Enterprise Security"]
-data_models = [[u'Endpoint'], [u'Endpoint'], [u'Endpoint'], [u'Endpoint'], [u'Endpoint'], [u'Endpoint'], [u'Network_Traffic'], [u'Web'], [u'Web'], [u'Network_Traffic'], [u'Endpoint'], [u'Endpoint'], [u'Endpoint']]
+mappings = {"mitre_attack": ["Execution"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.CM"]}
+investigative_searches = ["Get Authentication Logs For Endpoint", "Get Backup Logs For Endpoint", "Get Notable History", "Get Parent Process Info", "Get Process Info", "Get Process Information For Port Activity", "Get Risk Modifiers For Endpoint", "Get Risk Modifiers For User", "Get Update Logs For Endpoint", "Get User Information from Identity Table", "Get Vulnerability Logs For Endpoint", "Investigate Successful Remote Desktop Authentications", "Investigate Web Activity From Host"]
+support_searches = ["Add Prohibited Processes to Enterprise Security", "Monitor Successful Backups", "Monitor Unsuccessful Backups", "Windows Updates Install Failures", "Windows Updates Install Successes"]
+data_models = ["Endpoint", "Network_Traffic", "Web"]
 description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the SamSam ransomware, including looking for file writes associated with SamSam, RDP brute force attacks, the presence of files with SamSam ransomware extensions, suspicious psexec use, and more.
 narrative = The first version of the SamSam ransomware (a.k.a. Samas or SamsamCrypt) was launched in 2015 by a group of Iranian threat actors. The malicious software has affected and continues to affect thousands of victims and has raised almost $6M in ransom.\
 \
@@ -779,9 +817,10 @@ id = 6d3306f6-bb2b-4219-8609-8efad64032f2
 version = 1.0
 reference = ["https://meltdownattack.com/"]
 detection_searches = ["ESCU - Spectre and Meltdown Vulnerable Systems - Rule"]
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint"]
-support_searches = ["ESCU - Systems Ready for Spectre-Meltdown Windows Patch"]
-data_models = [[u'Vulnerabilities']]
+mappings = {"cis20": ["CIS 4"], "nist": ["ID.RA", "RS.MI", "PR.IP", "DE.CM"]}
+investigative_searches = ["Get Authentication Logs For Endpoint", "Get Notable History", "Get Notable Info", "Get Risk Modifiers For Endpoint", "Get Risk Modifiers For User", "Get User Information from Identity Table"]
+support_searches = ["Systems Ready for Spectre-Meltdown Windows Patch"]
+data_models = ["Vulnerabilities"]
 description = Assess and mitigate your systems' vulnerability to Spectre and Meltdown exploitation with the searches in this Analytic Story.
 narrative = Meltdown and Spectre exploit critical vulnerabilities in modern CPUs that allow unintended access to data in memory. This Analytic Story will help you identify the systems can be patched for these vulnerabilities, as well as those that still need to be patched.
 
@@ -793,9 +832,10 @@ id = 4e692b96-de2d-4bd1-9105-37e2368a8db1
 version = 1.0
 reference = ["http://www.splunk.com/view/SP-CAAAPQ6#announce", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4859"]
 detection_searches = ["ESCU - Open Redirect in Splunk Web - Rule"]
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint"]
+mappings = {"mitre_attack": ["Defense Evasion", "Exploitation of Vulnerability"], "cis20": ["CIS 3", "CIS 4", "CIS 18"], "kill_chain_phases": ["Delivery"], "nist": ["ID.RA", "RS.MI", "PR.PT", "PR.AC", "PR.IP", "DE.CM"]}
+investigative_searches = ["Get Authentication Logs For Endpoint", "Get Notable History", "Get Notable Info", "Get Risk Modifiers For Endpoint", "Get Risk Modifiers For User", "Get User Information from Identity Table"]
 support_searches = []
-data_models = [[]]
+data_models = []
 description = Keeping your Splunk deployment up to date is critical and may help you reduce the risk of CVE-2016-4859, an open-redirection vulnerability within some older versions of Splunk Enterprise. The detection search will help ensure that users are being properly authenticated and not being redirected to malicious domains.
 narrative = This Analytic Story is associated with CVE-2016-4859, an open-redirect vulnerability in the following versions of Splunk Enterprise:\
 \
@@ -825,7 +865,8 @@ id = 1fc34cbc-34e9-43ba-87ab-6811c9e95400
 version = 1.0
 reference = ["https://nvd.nist.gov/vuln/detail/CVE-2018-11409", "https://www.splunk.com/view/SP-CAAAP5E#VulnerabilityDescriptionsandRatings", "https://www.exploit-db.com/exploits/44865/"]
 detection_searches = ["ESCU - Splunk Enterprise Information Disclosure - Rule"]
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Investigate Web Activity From src_ip", "ESCU - Investigate Network Traffic From src_ip"]
+mappings = {"mitre_attack": ["Defense Evasion", "Exploitation of Vulnerability"], "cis20": ["CIS 3", "CIS 4", "CIS 18"], "kill_chain_phases": ["Delivery"], "nist": ["ID.RA", "RS.MI", "PR.PT", "PR.AC", "PR.IP", "DE.CM"]}
+investigative_searches = ["Get Notable History", "Get Notable Info", "Get Risk Modifiers For Endpoint", "Investigate Network Traffic From src_ip", "Investigate Web Activity From src_ip"]
 support_searches = []
 data_models = []
 description = Reduce the risk of CVE-2018-11409, an information disclosure vulnerability within some older versions of Splunk Enterprise, with searches designed to help ensure that your Splunk system does not leak information to authenticated users.
@@ -845,8 +886,9 @@ id = 2e8948a5-5239-406b-b56b-6c50f1268af3
 version = 1.0
 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
 detection_searches = ["ESCU - EC2 Instance Started In Previously Unseen Region - Rule", "ESCU - Abnormally High AWS Instances Terminated by User - Rule", "ESCU - Abnormally High AWS Instances Launched by User - Rule", "ESCU - EC2 Instance Started With Previously Unseen User - Rule"]
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get EC2 Instance Details by instanceId", "ESCU - Investigate AWS activities via region name", "ESCU - AWS Investigate User Activities By ARN", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get EC2 Instance Details by instanceId", "ESCU - Investigate AWS activities via region name", "ESCU - AWS Investigate User Activities By ARN", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get EC2 Instance Details by instanceId", "ESCU - Investigate AWS activities via region name", "ESCU - AWS Investigate User Activities By ARN", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get EC2 Instance Details by instanceId", "ESCU - Investigate AWS activities via region name", "ESCU - AWS Investigate User Activities By ARN"]
-support_searches = ["ESCU - Previously Seen AWS Regions", "ESCU - Previously Seen EC2 Launches By User", "ESCU - Previously Seen AWS Regions", "ESCU - Previously Seen EC2 Launches By User", "ESCU - Previously Seen AWS Regions", "ESCU - Previously Seen EC2 Launches By User", "ESCU - Previously Seen AWS Regions", "ESCU - Previously Seen EC2 Launches By User"]
+mappings = {"mitre_attack": ["Defense Evasion"], "cis20": ["CIS 1"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["ID.AM"]}
+investigative_searches = ["AWS Investigate User Activities By ARN", "Get EC2 Instance Details by instanceId", "Get Notable History", "Get Notable Info", "Get User Information from Identity Table", "Investigate AWS activities via region name"]
+support_searches = ["Previously Seen AWS Regions", "Previously Seen EC2 Launches By User"]
 data_models = []
 description = Use the searches in this Analytic Story to monitor your AWS EC2 instances for evidence of anomalous activity and suspicious behaviors, such as EC2 instances that originate from unusual locations or those launched by previously unseen users (among others). Included investigative searches will help you probe more deeply, when the information warrants it.
 narrative = AWS CloudTrail is an AWS service that helps you enable governance, compliance, and risk auditing within your AWS account. Actions taken by a user, role, or an AWS service are recorded as events in CloudTrail. It is crucial for a company to monitor events and actions taken in the AWS Console, AWS command-line interface, and AWS SDKs and APIs to ensure that your EC2 instances are not vulnerable to attacks. This Analytic Story identifies suspicious activities in your AWS EC2 instances and helps you respond and investigate those activities.
@@ -859,8 +901,9 @@ id = 2e8948a5-5239-406b-b56b-6c59f1268af3
 version = 1.0
 reference = ["https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html   "]
 detection_searches = ["ESCU - Detect new user AWS Console Login - Rule"]
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - AWS Investigate User Activities By ARN"]
-support_searches = ["ESCU - Previously seen users in CloudTrail"]
+mappings = {"mitre_attack": ["Credential Access"], "cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.DP", "DE.AE"]}
+investigative_searches = ["AWS Investigate User Activities By ARN", "Get Notable History", "Get Notable Info", "Get User Information from Identity Table"]
+support_searches = ["Previously seen users in CloudTrail"]
 data_models = []
 description = Monitor your AWS authentication events using your CloudTrail logs. Searches within this Analytic Story will help you stay aware of and investigate suspicious logins.
 narrative = It is important to monitor and control who has access to your AWS infrastructure. Detecting suspicious logins to your AWS infrastructure will provide good starting points for investigations. Abusive behaviors caused by compromised credentials can lead to direct monetary costs, as you will be billed for any EC2 instances created by the attacker.
@@ -873,8 +916,9 @@ id = 2e8948a5-5239-406b-b56b-6c50w3168af3
 version = 2.0
 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://www.tripwire.com/state-of-security/security-data-protection/cloud/public-aws-s3-buckets-writable/"]
 detection_searches = ["ESCU - Detect New Open S3 buckets - Rule", "ESCU - Detect S3 access from a new IP - Rule", "ESCU - Detect Spike in S3 Bucket deletion - Rule"]
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - AWS S3 Bucket details via bucketName", "ESCU - Investigate AWS activities via region name", "ESCU - AWS Investigate User Activities By ARN", "ESCU - Get All AWS Activity From IP Address", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - AWS S3 Bucket details via bucketName", "ESCU - Investigate AWS activities via region name", "ESCU - AWS Investigate User Activities By ARN", "ESCU - Get All AWS Activity From IP Address", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - AWS S3 Bucket details via bucketName", "ESCU - Investigate AWS activities via region name", "ESCU - AWS Investigate User Activities By ARN", "ESCU - Get All AWS Activity From IP Address"]
-support_searches = ["ESCU - Previously seen S3 bucket access by remote IP", "ESCU - Baseline of S3 Bucket deletion activity by ARN", "ESCU - Previously seen S3 bucket access by remote IP", "ESCU - Baseline of S3 Bucket deletion activity by ARN", "ESCU - Previously seen S3 bucket access by remote IP", "ESCU - Baseline of S3 Bucket deletion activity by ARN"]
+mappings = {"mitre_attack": ["Credential Access", "Execution"], "cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.DP", "DE.CM", "PR.AC"]}
+investigative_searches = ["AWS Investigate User Activities By ARN", "AWS S3 Bucket details via bucketName", "Get All AWS Activity From IP Address", "Get Notable History", "Get Notable Info", "Get User Information from Identity Table", "Investigate AWS activities via region name"]
+support_searches = ["Baseline of S3 Bucket deletion activity by ARN", "Previously seen S3 bucket access by remote IP"]
 data_models = []
 description = Use the searches in this Analytic Story to monitor your AWS S3 buckets for evidence of anomalous activity and suspicious behaviors, such as detecting open S3 buckets and buckets being accessed from a new IP. The contextual and investigative searches will give you more information, when required.
 narrative = As cloud computing has exploded, so has the number of creative attacks on virtual environments. And as the number-two cloud-service provider, Amazon Web Services (AWS) has certainly had its share.\
@@ -891,8 +935,9 @@ id = 2e8948a5-5239-406b-b56b-6c50f2168af3
 version = 1.0
 reference = ["https://rhinosecuritylabs.com/aws/hiding-cloudcobalt-strike-beacon-c2-using-amazon-apis/"]
 detection_searches = ["ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule"]
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - AWS Network Interface details via resourceId", "ESCU - Get All AWS Activity From IP Address"]
-support_searches = ["ESCU - Baseline of blocked outbound traffic from AWS"]
+mappings = {"mitre_attack": ["Exfiltration", "Command and Control"], "cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "nist": ["DE.AE", "DE.CM", "PR.AC"]}
+investigative_searches = ["AWS Network Interface details via resourceId", "Get All AWS Activity From IP Address", "Get Notable History", "Get Notable Info"]
+support_searches = ["Baseline of blocked outbound traffic from AWS"]
 data_models = []
 description = Leverage these searches to monitor your AWS network traffic for evidence of anomalous activity and suspicious behaviors, such as a spike in blocked outbound traffic in your virtual private cloud (VPC).
 narrative = A virtual private cloud (VPC) is an on-demand managed cloud-computing service that isolates computing resources for each client. Inside the VPC container, the environment resembles a physical network. \
@@ -911,9 +956,10 @@ id = f4368ddf-d59f-4192-84f6-778ac5a3ffc7
 version = 2.0
 reference = ["https://attack.mitre.org/wiki/Technique/T1059", "https://www.microsoft.com/en-us/wdsi/threats/macro-malware", "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"]
 detection_searches = ["ESCU - First time seen command line argument - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Detect Prohibited Applications Spawning cmd.exe - Rule", "ESCU - Detect Use of cmd.exe to Launch Script Interpreters - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule"]
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Investigate Web Activity From Host", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Investigate Web Activity From Host", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Registry Activities", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Investigate Web Activity From Host", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Investigate Web Activity From Host"]
-support_searches = ["ESCU - Previously seen command line arguments", "ESCU - Previously seen command line arguments"]
-data_models = [[u'Endpoint'], [u'Endpoint'], [u'Endpoint'], [u'Endpoint'], [u'Endpoint']]
+mappings = {"mitre_attack": ["Execution"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.PT", "DE.CM"]}
+investigative_searches = ["Get Authentication Logs For Endpoint", "Get Notable History", "Get Notable Info", "Get Parent Process Info", "Get Process Info", "Get User Information from Identity Table", "Investigate Web Activity From Host"]
+support_searches = ["Previously seen command line arguments"]
+data_models = ["Endpoint"]
 description = Leveraging the Windows command-line interface (CLI) is one of the most common attack techniques--one that is also detailed in the MITRE ATT&CK framework. Use this Analytic Story to help you identify unusual or suspicious use of the CLI on Windows systems.
 narrative = The ability to execute arbitrary commands via the Windows CLI is a primary goal for the adversary. With access to the shell, an attacker can easily run scripts and interact with the target system. Often, attackers may only have limited access to the shell or may obtain access in unusual ways. In addition, malware may execute and interact with the CLI in ways that would be considered unusual and inconsistent with typical user activity. This provides defenders with opportunities to identify suspicious use and investigate, as appropriate. This Analytic Story contains various searches to help identify this suspicious activity, as well as others to aid you in deeper investigation.
 
@@ -925,9 +971,10 @@ id = 3c3835c0-255d-4f9e-ab84-e29ec9ec9b56
 version = 1.0
 reference = ["http://blogs.splunk.com/2015/10/01/random-words-on-entropy-and-dns/", "http://www.darkreading.com/analytics/security-monitoring/got-malware-three-signs-revealed-in-dns-traffic/d/d-id/1139680", "https://live.paloaltonetworks.com/t5/Threat-Vulnerability-Articles/What-are-suspicious-DNS-queries/ta-p/71454"]
 detection_searches = ["ESCU - Excessive DNS Failures - Rule", "ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule"]
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get DNS Server History for a host", "ESCU - Get DNS traffic ratio", "ESCU - Get Process responsible for the DNS traffic", "ESCU - Get DNS Server History for a host", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get DNS Server History for a host", "ESCU - Get DNS traffic ratio", "ESCU - Get Process responsible for the DNS traffic", "ESCU - Get DNS Server History for a host", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get DNS Server History for a host", "ESCU - Get DNS traffic ratio", "ESCU - Get Process responsible for the DNS traffic", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get DNS Server History for a host", "ESCU - Get DNS traffic ratio", "ESCU - Get Process responsible for the DNS traffic", "ESCU - Get DNS Server History for a host"]
+mappings = {"mitre_attack": ["Exfiltration", "Exfiltration Over Alternative Protocol", "Command and Control", "Commonly Used Port"], "cis20": ["CIS 8", "CIS 9", "CIS 12"], "kill_chain_phases": ["Command and Control"], "nist": ["PR.PT", "DE.AE", "DE.CM"]}
+investigative_searches = ["Get Authentication Logs For Endpoint", "Get DNS Server History for a host", "Get DNS traffic ratio", "Get Notable History", "Get Notable Info", "Get Process responsible for the DNS traffic", "Get Risk Modifiers For Endpoint", "Get Risk Modifiers For User", "Get User Information from Identity Table"]
 support_searches = []
-data_models = [[u'Network_Resolution'], [u'Network_Resolution'], [u'Network_Resolution'], [u'Network_Resolution'], [u'Network_Resolution'], [u'Network_Resolution'], [u'Network_Resolution']]
+data_models = ["Network_Resolution"]
 description = Attackers often attempt to hide within or otherwise abuse the domain name system (DNS). You can thwart attempts to manipulate this omnipresent protocol by monitoring for these types of abuses.
 narrative = Although DNS is one of the fundamental underlying protocols that make the Internet work, it is often ignored (perhaps because of its complexity and effectiveness).  However, attackers have discovered ways to abuse the protocol to meet their objectives. One potential abuse involves manipulating DNS to hijack traffic and redirect it to an IP address under the attacker's control. This could inadvertently send users intending to visit google.com, for example, to an unrelated malicious website. Another technique involves using the DNS protocol for command-and-control activities with the attacker's malicious code or to covertly exfiltrate data. The searches within this Analytic Story look for these types of abuses.
 
@@ -939,9 +986,10 @@ id = 2b1800dd-92f9-47ec-a981-fdf1351e5d55
 version = 1.0
 reference = ["https://www.splunk.com/blog/2015/06/26/phishing-hits-a-new-level-of-quality/"]
 detection_searches = ["ESCU - Suspicious Email Attachment Extensions - Rule", "ESCU - Email Attachments With Lots Of Spaces - Rule"]
-investigative_searches = ["ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Email Info", "ESCU - Get Emails From Specific Sender", "ESCU - Investigate Web Activity From Host", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Email Info", "ESCU - Get Emails From Specific Sender", "ESCU - Investigate Web Activity From Host"]
+mappings = {"mitre_attack": ["Execution", "Defense Evasion"], "cis20": ["CIS 3", "CIS 7", "CIS 12"], "kill_chain_phases": ["Delivery"], "nist": ["DE.AE", "PR.IP"]}
+investigative_searches = ["Get Authentication Logs For Endpoint", "Get Email Info", "Get Emails From Specific Sender", "Get Notable History", "Get Risk Modifiers For Endpoint", "Get Risk Modifiers For User", "Get User Information from Identity Table", "Investigate Web Activity From Host"]
 support_searches = []
-data_models = [[u'Email'], [u'Email']]
+data_models = ["Email"]
 description = Email remains one of the primary means for attackers to gain an initial foothold within the modern enterprise. Detect and investigate suspicious emails in your environment with the help of the searches in this Analytic Story.
 narrative = It is a common practice for attackers of all types to leverage targeted spearphishing campaigns and mass mailers to deliver weaponized email messages and attachments. Fortunately, there are a number of ways to monitor email data in Splunk to detect suspicious content.\
 \
@@ -961,9 +1009,10 @@ id = 2b1800dd-92f9-47dd-a981-fdf13w1q5d55
 version = 1.0
 reference = ["https://redcanary.com/blog/windows-registry-attacks-threat-detection/", "https://medium.com/@mbromileyDFIR/malware-monday-aebb456356c5", "https://attack.mitre.org/wiki/Technique/T1170"]
 detection_searches = ["ESCU - Detect mshta.exe running scripts in command-line arguments - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Detect Prohibited Applications Spawning cmd.exe - Rule"]
-investigative_searches = ["ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Registry Activities", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Registry Activities", "ESCU - Get Parent Process Info"]
+mappings = {"mitre_attack": ["Persistence", "Registry Run Keys / Start Folder", "AppInit DLLs", "Authentication Package"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.PT", "DE.CM", "DE.AE"]}
+investigative_searches = ["Get Authentication Logs For Endpoint", "Get Notable History", "Get Parent Process Info", "Get Process Info", "Get Registry Activities", "Get Risk Modifiers For Endpoint", "Get Risk Modifiers For User", "Get User Information from Identity Table"]
 support_searches = []
-data_models = [[u'Endpoint'], [u'Endpoint'], [u'Endpoint']]
+data_models = ["Endpoint"]
 description = Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code.
 narrative = One common adversary tactic is to bypass application white-listing solutions via the mshta.exe process, which executes Microsoft HTML applications with the .hta suffix. In these cases, attackers use the trusted Windows utility to eproxy execution of malicious files, whether an .hta application, javascript, or VBScript.\
 \
@@ -979,9 +1028,10 @@ id = c8ddc5be-69bc-4202-b3ab-4010b27d7ad5
 version = 2.0
 reference = ["https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf", "https://www.fireeye.com/blog/threat-research/2017/03/wmimplant_a_wmi_ba.html"]
 detection_searches = ["ESCU - Remote WMI Command Attempt - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - WMI Permanent Event Subscription - Rule", "ESCU - WMI Permanent Event Subscription - Sysmon - Rule", "ESCU - WMI Temporary Event Subscription - Rule", "ESCU - Process Execution via WMI - Rule", "ESCU - Script Execution via WMI - Rule"]
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Sysmon WMI Activity for Host", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Sysmon WMI Activity for Host", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Sysmon WMI Activity for Host", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Sysmon WMI Activity for Host", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Sysmon WMI Activity for Host", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Sysmon WMI Activity for Host", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Sysmon WMI Activity for Host"]
+mappings = {"mitre_attack": ["Execution", "Windows Management Instrumentation", "Persistence", "Windows Management Instrumentation Event Subscription"], "cis20": ["CIS 3", "CIS 5"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"]}
+investigative_searches = ["Get Authentication Logs For Endpoint", "Get Notable History", "Get Notable Info", "Get Process Info", "Get Risk Modifiers For Endpoint", "Get Risk Modifiers For User", "Get Sysmon WMI Activity for Host", "Get User Information from Identity Table"]
 support_searches = []
-data_models = [[u'Endpoint'], [u'Endpoint'], [u'Endpoint'], [u'Endpoint']]
+data_models = ["Endpoint"]
 description = Attackers are increasingly abusing Windows Management Instrumentation (WMI), a framework and associated utilities available on all modern Windows operating systems. Because WMI can be leveraged to manage both local and remote systems, it is important to identify the processes executed and the user context within which the activity occurred.
 narrative = WMI is a Microsoft infrastructure for management data and operations on Windows operating systems. It includes of a set of utilities that can be leveraged to manage both local and remote Windows systems. Attackers are increasingly turning to WMI abuse in their efforts to conduct nefarious tasks, such as reconnaissance, detection of antivirus and virtual machines, code execution, lateral movement, persistence, and data exfiltration. \
 \
@@ -997,9 +1047,10 @@ id = 2b1800dd-92f9-47dd-a981-fdf1351e5d55
 version = 1.0
 reference = ["https://redcanary.com/blog/windows-registry-attacks-threat-detection/", "https://attack.mitre.org/wiki/Technique/T1112"]
 detection_searches = ["ESCU - Remote Registry Key modifications - Rule", "ESCU - Suspicious Changes to File Associations - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Reg.exe used to hide files/directories via registry keys - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule"]
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info"]
+mappings = {"mitre_attack": ["Persistence", "Change Default File Association"], "cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.CM", "PR.PT", "PR.IP"]}
+investigative_searches = ["Get Authentication Logs For Endpoint", "Get Notable History", "Get Parent Process Info", "Get Process Info", "Get Registry Activities", "Get Risk Modifiers For Endpoint", "Get Risk Modifiers For User", "Get User Information from Identity Table"]
 support_searches = []
-data_models = [[u'Endpoint'], [u'Endpoint'], [u'Endpoint'], [u'Change_Analysis'], [u'Endpoint'], [u'Endpoint'], [u'Endpoint'], [u'Endpoint']]
+data_models = ["Change_Analysis", "Endpoint"]
 description = Monitor and detect registry changes initiated from remote locations, which can be a sign that an attacker has infiltrated your system.
 narrative = Attackers are developing increasingly sophisticated techniques for hijacking target servers, while evading detection. One such technique that has become progressively more common is registry modification.\
 \
@@ -1015,8 +1066,9 @@ id = 73de57ef-0dfc-411f-b1e7-fa24428aeae0
 version = 1.0
 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
 detection_searches = ["ESCU - EC2 Instance Modified With Previously Unseen User - Rule"]
-investigative_searches = ["ESCU - Get Notable History", "ESCU - Get EC2 Instance Details by instanceId", "ESCU - AWS Investigate User Activities By ARN"]
-support_searches = ["ESCU - Previously Seen EC2 Modifications By User"]
+mappings = {"cis20": ["CIS 1"], "nist": ["ID.AM"]}
+investigative_searches = ["AWS Investigate User Activities By ARN", "Get EC2 Instance Details by instanceId", "Get Notable History"]
+support_searches = ["Previously Seen EC2 Modifications By User"]
 data_models = []
 description = Identify unusual changes to your AWS EC2 instances that may indicate malicious activity. Modifications to your EC2 instances by previously unseen users is an example of an activity that may warrant further investigation.
 narrative = A common attack technique is to infiltrate a cloud instance and make modifications. The adversary can then secure access to your infrastructure or hide their activities. So it's important to stay alert to changes that may indicate that your environment has been compromised. \
@@ -1031,9 +1083,10 @@ id = f4368e3f-d59f-4192-84f6-748ac5a3ddb6
 version = 2.0
 reference = ["https://www.fireeye.com/blog/threat-research/2017/08/monitoring-windows-console-activity-part-two.html", "https://www.splunk.com/pdfs/technical-briefs/advanced-threat-detection-and-response-tech-brief.pdf", "https://www.sans.org/reading-room/whitepapers/logging/detecting-security-incidents-windows-workstation-event-logs-34262"]
 detection_searches = ["ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Detect Rare Executables - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - Detect processes used for System Network Configuration Discovery - Rule"]
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Investigate Web Activity From Host", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Investigate Web Activity From Host", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Investigate Web Activity From Host", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Investigate Web Activity From Host", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Investigate Web Activity From Host"]
+mappings = {"mitre_attack": ["Execution"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.PT", "DE.CM"]}
+investigative_searches = ["Get Authentication Logs For Endpoint", "Get Notable History", "Get Process Info", "Get Risk Modifiers For Endpoint", "Get Risk Modifiers For User", "Get User Information from Identity Table", "Investigate Web Activity From Host"]
 support_searches = []
-data_models = [[u'Endpoint'], [u'Endpoint'], [u'Endpoint'], [u'Endpoint'], [u'Endpoint'], [u'Endpoint']]
+data_models = ["Endpoint"]
 description = Quickly identify systems running new or unusual processes in your environment that could be indicators of suspicious activity. Processes run from unusual locations, those with conspicuously long command lines, and rare executables are all examples of activities that may warrant deeper investigation.
 narrative = Being able to profile a host's processes within your environment can help you more quickly identify processes that seem out of place when compared to the rest of the population of hosts or asset types.\
 \
@@ -1049,9 +1102,10 @@ id = 826e6431-aeef-41b4-9fc0-6d0985d65a21
 version = 1.0
 reference = ["https://www.monkey.org/~dugsong/dsniff/"]
 detection_searches = ["ESCU - Protocols passing authentication in cleartext - Rule"]
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Information For Port Activity"]
+mappings = {"mitre_attack": ["Credential Access", "Lateral Movement", "Collection"], "cis20": ["CIS 9", "CIS 14"], "kill_chain_phases": ["Reconnaissance", "Actions on Objectives"], "nist": ["PR.PT", "DE.AE", "PR.AC", "PR.DS"]}
+investigative_searches = ["Get Notable History", "Get Notable Info", "Get Process Information For Port Activity", "Get Risk Modifiers For Endpoint", "Get Risk Modifiers For User", "Get User Information from Identity Table"]
 support_searches = []
-data_models = [[u'Network_Traffic']]
+data_models = ["Network_Traffic"]
 description = Leverage searches that detect cleartext network protocols that may leak credentials or should otherwise be encrypted.
 narrative = Various legacy protocols operate by default in the clear, without the protections of encryption. This potentially leaks sensitive information that can be exploited by passively sniffing network traffic. Depending on the protocol, this information could be highly sensitive, or could allow for session hijacking. In addition, these protocols send authentication information, which would allow for the harvesting of usernames and passwords that could potentially be used to authenticate and compromise secondary systems.
 
@@ -1063,7 +1117,8 @@ id = 31337aaa-bc22-4752-b599-ef112dq1dq7a
 version = 1.0
 reference = ["https://www.fbi.gov/scams-and-safety/common-fraud-schemes/internet-fraud", "https://www.fbi.gov/news/stories/2017-internet-crime-report-released-050718", "https://www.otalliance.org/news-events/press-releases/online-trust-alliance-reports-doubling-cyber-incidents-2017-0"]
 detection_searches = ["ESCU - Web Fraud - Account Harvesting - Rule", "ESCU - Web Fraud - Anomalous User Clickspeed - Rule", "ESCU - Web Fraud - Password Sharing Across Accounts - Rule"]
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get Emails From Specific Sender", "ESCU - Get Web Session Information via session_id", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get Emails From Specific Sender", "ESCU - Get Web Session Information via session_id", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get Emails From Specific Sender", "ESCU - Get Web Session Information via session_id"]
+mappings = {"mitre_attack": ["Valid Accounts"], "cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.DP"]}
+investigative_searches = ["Get Emails From Specific Sender", "Get Notable History", "Get Notable Info", "Get Web Session Information via session_id"]
 support_searches = []
 data_models = []
 description = Monitor your environment for activity consistent with common attack techniques bad actors use when attempting to compromise web servers or other web-related assets.
@@ -1087,9 +1142,10 @@ id = 56e24a28-5003-4047-b2db-e8f3c4618064
 version = 1.0
 reference = ["https://attack.mitre.org/wiki/Defense_Evasion"]
 detection_searches = ["ESCU - Suspicious Reg.exe Process - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Hiding Files And Directories With Attrib.exe - Rule", "ESCU - Reg.exe used to hide files/directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule"]
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info"]
+mappings = {"mitre_attack": ["Defense Evasion", "Modify Registry", "Disabling Security Tools"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.CM"]}
+investigative_searches = ["Get Authentication Logs For Endpoint", "Get Notable History", "Get Notable Info", "Get Parent Process Info", "Get Process Info", "Get User Information from Identity Table"]
 support_searches = []
-data_models = [[u'Endpoint'], [u'Endpoint'], [u'Endpoint'], [u'Endpoint'], [u'Endpoint']]
+data_models = ["Endpoint"]
 description = Detect tactics used by malware to evade defenses on Windows endpoints. A few of these include suspicious `reg.exe` processes, files hidden with `attrib.exe` and disabling user-account control, among many others
 narrative = Defense evasion is a tactic--identified in the MITRE ATT&CK framework--that adversaries employ in a variety of ways to bypass or defeat defensive security measures. There are many techniques enumerated by the MITRE ATT&CK framework that are applicable in this context. This Analytic Story includes searches designed to identify the use of such techniques on Windows platforms.
 
@@ -1101,9 +1157,10 @@ id = 30552a76-ac78-48e4-b3c0-de4e34e9563d
 version = 1.0
 reference = ["https://blog.malwarebytes.com/cybercrime/2013/12/file-extensions-2/", "https://attack.mitre.org/wiki/Technique/T1042"]
 detection_searches = ["ESCU - Execution of File with Multiple Extensions - Rule", "ESCU - Execution of File With Spaces Before Extension - Rule", "ESCU - Suspicious Changes to File Associations - Rule"]
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info"]
+mappings = {"mitre_attack": ["Persistence", "Change Default File Association"], "cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.CM", "PR.PT", "PR.IP"]}
+investigative_searches = ["Get Authentication Logs For Endpoint", "Get Notable History", "Get Notable Info", "Get Parent Process Info", "Get Process Info", "Get Risk Modifiers For Endpoint", "Get Risk Modifiers For User", "Get User Information from Identity Table"]
 support_searches = []
-data_models = [[u'Endpoint'], [u'Endpoint'], [u'Endpoint']]
+data_models = ["Endpoint"]
 description = Detect and investigate suspected abuse of file extensions and Windows file associations. Some of the malicious behaviors involved may include inserting spaces before file extensions or prepending the file extension with a different one, among other techniques.
 narrative = Attackers use a variety of techniques to entice users to run malicious code or to persist on an endpoint. One way to accomplish these goals is to leverage file extensions and the mechanism Windows uses to associate files with specific applications. \
 \
@@ -1123,9 +1180,10 @@ id = b6db2c60-a281-48b4-95f1-2cd99ed56835
 version = 2.0
 reference = ["https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/", "https://zeltser.com/security-incident-log-review-checklist/", "http://journeyintoir.blogspot.com/2013/01/re-introducing-usnjrnl.html"]
 detection_searches = ["ESCU - Deleting Shadow Copies - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - USN Journal Deletion - Rule"]
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info"]
+mappings = {"mitre_attack": ["Defense Evasion", "Indicator Removal on Host"], "cis20": ["CIS 3", "CIS 5", "CIS 6"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.DP", "PR.IP", "PR.AC", "PR.AT", "DE.AE"]}
+investigative_searches = ["Get Authentication Logs For Endpoint", "Get Notable History", "Get Notable Info", "Get Process Info", "Get Risk Modifiers For Endpoint", "Get Risk Modifiers For User", "Get User Information from Identity Table"]
 support_searches = []
-data_models = [[u'Endpoint'], [u'Endpoint'], [u'Endpoint']]
+data_models = ["Endpoint"]
 description = Adversaries often try to cover their tracks by manipulating Windows logs. Use these searches to help you monitor for suspicious activity surrounding log files--an essential component of an effective defense.
 narrative = Because attackers often modify system logs to cover their tracks and/or to thwart the investigative process, log monitoring is an industry-recognized best practice. While there are legitimate reasons to manipulate system logs, it is still worthwhile to keep track of who manipulated the logs, when they manipulated them, and in what way they manipulated them (determining which accesses, tools, or utilities were employed). Even if no malicious activity is detected, the knowledge of an attempt to manipulate system logs may be indicative of a broader security risk that should be thoroughly investigated.\
 \
@@ -1139,9 +1197,10 @@ id = 30874d4f-20a1-488f-85ec-5d52ef74e3f9
 version = 2.0
 reference = ["http://www.fuzzysecurity.com/tutorials/19.html", "https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html", "http://resources.infosecinstitute.com/common-malware-persistence-mechanisms/", "https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html", "https://www.defcon.org/images/defcon-22/dc-22-presentations/Bloxham/DEFCON-22-Brady-Bloxham-Windows-API-Abuse-UPDATED.pdf"]
 detection_searches = ["ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Shim Database Installation With Suspicious Parameters - Rule", "ESCU - Shim Database File Creation - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Sc.exe Manipulating Windows Services - Rule", "ESCU - Reg.exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Hiding Files And Directories With Attrib.exe - Rule", "ESCU - Reg.exe used to hide files/directories via registry keys - Rule", "ESCU - Detect Path Interception By Creation Of program.exe - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Remote Registry Key modifications - Rule"]
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info"]
-support_searches = ["ESCU - Previously Seen Running Windows Services", "ESCU - Previously Seen Running Windows Services"]
-data_models = [[u'Change_Analysis'], [u'Endpoint'], [u'Endpoint'], [u'Endpoint'], [u'Endpoint'], [u'Endpoint'], [u'Endpoint'], [u'Endpoint'], [u'Endpoint'], [u'Endpoint'], [u'Endpoint'], [u'Endpoint']]
+mappings = {"mitre_attack": ["Persistence", "Application Shimming"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.CM"]}
+investigative_searches = ["Get Authentication Logs For Endpoint", "Get Notable History", "Get Notable Info", "Get Parent Process Info", "Get Process Info", "Get Risk Modifiers For Endpoint", "Get Risk Modifiers For User", "Get User Information from Identity Table"]
+support_searches = []
+data_models = ["Change_Analysis", "Endpoint"]
 description = Monitor for activities and techniques associated with maintaining persistence on a Windows system--a sign that an adversary may have compromised your environment.
 narrative = Maintaining persistence is one of the first steps taken by attackers after the initial compromise. Attackers leverage various custom and built-in tools to ensure survivability and persistent access within a compromised enterprise. This Analytic Story provides searches to help you identify various behaviors used by attackers to maintain persistent access to a Windows environment.
 
@@ -1153,9 +1212,10 @@ id = 644e22d3-598a-429c-a007-16fdb802cae5
 version = 2.0
 reference = ["https://attack.mitre.org/wiki/Privilege_Escalation"]
 detection_searches = ["ESCU - Overwriting Accessibility Binaries - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Child Processes of Spoolsv.exe - Rule"]
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info"]
+mappings = {"mitre_attack": ["Execution", "Accessibility Features"], "cis20": ["CIS 2"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["ID.AM", "PR.DS"]}
+investigative_searches = ["Get Authentication Logs For Endpoint", "Get Notable History", "Get Notable Info", "Get Parent Process Info", "Get Process Info", "Get Risk Modifiers For Endpoint", "Get Risk Modifiers For User", "Get User Information from Identity Table"]
 support_searches = []
-data_models = [[u'Endpoint'], [u'Endpoint'], [u'Endpoint'], [u'Endpoint']]
+data_models = ["Endpoint"]
 description = Monitor for and investigate activities that may be associated with a Windows privilege-escalation attack, including unusual processes running on endpoints, modified registry keys, and more.
 narrative = Privilege escalation is a "land-and-expand" technique, wherein an adversary gains an initial foothold on a host and then exploits its weaknesses to increase his privileges. The motivation is simple: certain actions on a Windows machine--such as installing software--may require higher-level privileges than those the attacker initially acquired. By increasing his privilege level, the attacker can gain the control required to carry out his malicious ends. This Analytic Story provides searches to detect and investigate behaviors that attackers may use to elevate their privileges in your environment.
 
@@ -1167,9 +1227,10 @@ id = 6dbd810e-f66d-414b-8dfc-e46de55cbfe2
 version = 3.0
 reference = ["https://attack.mitre.org/wiki/Technique/T1050", "https://attack.mitre.org/wiki/Technique/T1031"]
 detection_searches = ["ESCU - Sc.exe Manipulating Windows Services - Rule", "ESCU - Reg.exe Manipulating Windows Services Registry Keys - Rule", "ESCU - First Time Seen Running Windows Service - Rule"]
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info"]
-support_searches = ["ESCU - Previously Seen Running Windows Services", "ESCU - Previously Seen Running Windows Services", "ESCU - Previously Seen Running Windows Services"]
-data_models = [[u'Endpoint'], [u'Endpoint']]
+mappings = {"mitre_attack": ["Persistence", "Privilege Escalation", "New Service", "Modify Existing Service", "Defense Evasion", "Disabling Security Tools"], "cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Installation"], "nist": ["PR.IP", "PR.PT", "PR.AC", "PR.AT", "DE.CM"]}
+investigative_searches = ["Get Authentication Logs For Endpoint", "Get Notable History", "Get Notable Info", "Get Parent Process Info", "Get Process Info", "Get Risk Modifiers For Endpoint", "Get Risk Modifiers For User", "Get User Information from Identity Table"]
+support_searches = ["Previously Seen Running Windows Services"]
+data_models = ["Endpoint"]
 description = Windows services are often used by attackers for persistence and the ability to load drivers or otherwise interact with the Windows kernel. This Analytic Story helps you monitor your environment for indications that Windows services are being modified or created in a suspicious manner.
 narrative = The Windows operating system uses a services architecture to allow for running code in the background, similar to a UNIX daemon. Attackers will often leverage Windows services for persistence, hiding in plain sight, seeking the ability to run privileged code that can interact with the kernel. In many cases, attackers will create a new service to host their malicious code. Attackers have also been observed modifying unnecessary or unused services to point to their own code, as opposed to what was intended. In these cases, attackers often use tools to create or modify services in ways that are not typical for most environments, providing opportunities for detection.
 
diff --git a/src/default/savedsearches.conf b/src/default/savedsearches.conf
index 6b4ad8a1a7..3e08b098e9 100644
--- a/src/default/savedsearches.conf
+++ b/src/default/savedsearches.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security-content
-# On Date: 2019-04-22T23:02:58 UTC
+# On Date: 2019-04-23T17:04:41 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
diff --git a/src/default/use_case_library.conf b/src/default/use_case_library.conf
index 887850ac04..24a965023b 100644
--- a/src/default/use_case_library.conf
+++ b/src/default/use_case_library.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security-content
-# On Date: 2019-04-22T23:02:58 UTC
+# On Date: 2019-04-23T17:04:41 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -14,7 +14,7 @@ version = 1.0
 reference = ["https://aws.amazon.com/blogs/security/aws-cloudtrail-now-tracks-cross-account-activity-to-its-origin/"]
 maintainers = [{"company": "Splunk", "email": "davidd@splunk.com", "name": "David Dorsey"}]
 spec_version = 1
-searches = ["ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule", "ESCU - Get Notable History", "ESCU - AWS Investigate User Activities By AccessKeyId", "ESCU - AWS Investigate User Activities By Source User", "ESCU - Previously Seen AWS Cross Account Activity"]
+searches = ["ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule", "ESCU - AWS Investigate User Activities By AccessKeyId", "ESCU - AWS Investigate User Activities By Source User", "ESCU - Get Notable History", "ESCU - Previously Seen AWS Cross Account Activity"]
 description = Track when a user assumes an IAM role in another AWS account to obtain cross-account access to services and resources in that account. Accessing new roles could be an indication of malicious activity.
 narrative = Amazon Web Services (AWS) admins manage access to AWS resources and services across the enterprise using AWS's Identity and Access Management (IAM) functionality. IAM provides the ability to create and manage AWS users, groups, and roles-each with their own unique set of privileges and defined access to specific resources (such as EC2 instances, the AWS Management Console, API, or the command-line interface). Unlike conventional (human) users, IAM roles are assumable by anyone in the organization. They provide users with dynamically created temporary security credentials that expire within a set time period.\
 \
@@ -29,7 +29,7 @@ version = 1.0
 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
 maintainers = [{"company": "Splunk", "email": "davidd@splunk.com", "name": "David Dorsey"}]
 spec_version = 1
-searches = ["ESCU - EC2 Instance Started In Previously Unseen Region - Rule", "ESCU - Abnormally High AWS Instances Launched by User - Rule", "ESCU - EC2 Instance Started With Previously Unseen Instance Type - Rule", "ESCU - EC2 Instance Started With Previously Unseen AMI - Rule", "ESCU - EC2 Instance Started With Previously Unseen User - Rule", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get EC2 Instance Details by instanceId", "ESCU - Investigate AWS activities via region name", "ESCU - AWS Investigate User Activities By ARN", "ESCU - Previously Seen AWS Regions", "ESCU - Previously Seen EC2 Launches By User", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get EC2 Instance Details by instanceId", "ESCU - Investigate AWS activities via region name", "ESCU - AWS Investigate User Activities By ARN", "ESCU - Previously Seen AWS Regions", "ESCU - Previously Seen EC2 Launches By User", "ESCU - Get EC2 Launch Details", "ESCU - Previously Seen AWS Regions", "ESCU - Previously Seen EC2 Launches By User", "ESCU - Previously Seen EC2 Instance Types", "ESCU - Previously Seen EC2 AMIs", "ESCU - Get EC2 Launch Details", "ESCU - Previously Seen AWS Regions", "ESCU - Previously Seen EC2 Launches By User", "ESCU - Previously Seen EC2 Instance Types", "ESCU - Previously Seen EC2 AMIs", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get EC2 Instance Details by instanceId", "ESCU - Investigate AWS activities via region name", "ESCU - AWS Investigate User Activities By ARN", "ESCU - Previously Seen AWS Regions", "ESCU - Previously Seen EC2 Launches By User"]
+searches = ["ESCU - EC2 Instance Started In Previously Unseen Region - Rule", "ESCU - Abnormally High AWS Instances Launched by User - Rule", "ESCU - EC2 Instance Started With Previously Unseen Instance Type - Rule", "ESCU - EC2 Instance Started With Previously Unseen AMI - Rule", "ESCU - EC2 Instance Started With Previously Unseen User - Rule", "ESCU - Get EC2 Launch Details", "ESCU - Previously Seen AWS Regions", "ESCU - Previously Seen EC2 AMIs", "ESCU - Previously Seen EC2 Instance Types", "ESCU - Previously Seen EC2 Launches By User"]
 description = Monitor your AWS EC2 instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or EC2 instances started by previously unseen users are just a few examples of potentially malicious behavior.
 narrative = Cryptomining is an intentionally difficult, resource-intensive business. Its complexity was designed into the process to ensure that the number of blocks mined each day would remain steady. So, it's par for the course that ambitious, but unscrupulous, miners make amassing the computing power of large enterprises--a practice known as cryptojacking--a top priority. \
 \
@@ -46,7 +46,7 @@ version = 2.0
 reference = ["https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Appendix_NACLs.html", "https://aws.amazon.com/blogs/security/how-to-help-prepare-for-ddos-attacks-by-reducing-your-attack-surface/"]
 maintainers = [{"company": "Splunk", "email": "bpatel@splunk.com", "name": "Bhavin Patel"}]
 spec_version = 1
-searches = ["ESCU - AWS Network Access Control List Created with All Open Ports - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Detect Spike in Network ACL Activity - Rule", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - AWS Network ACL Details from ID", "ESCU - AWS Network Interface details via resourceId", "ESCU - AWS Investigate User Activities By ARN", "ESCU - Baseline of blocked outbound traffic from AWS", "ESCU - Baseline of Network ACL Activity by ARN", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - AWS Network ACL Details from ID", "ESCU - AWS Network Interface details via resourceId", "ESCU - AWS Investigate User Activities By ARN", "ESCU - Baseline of blocked outbound traffic from AWS", "ESCU - Baseline of Network ACL Activity by ARN", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - AWS Network Interface details via resourceId", "ESCU - Get All AWS Activity From IP Address", "ESCU - Baseline of blocked outbound traffic from AWS", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - AWS Network ACL Details from ID", "ESCU - AWS Network Interface details via resourceId", "ESCU - AWS Investigate User Activities By ARN", "ESCU - Baseline of blocked outbound traffic from AWS", "ESCU - Baseline of Network ACL Activity by ARN"]
+searches = ["ESCU - AWS Network Access Control List Created with All Open Ports - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Detect Spike in Network ACL Activity - Rule", "ESCU - AWS Investigate User Activities By ARN", "ESCU - AWS Network ACL Details from ID", "ESCU - AWS Network Interface details via resourceId", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table", "ESCU - Baseline of Network ACL Activity by ARN", "ESCU - Baseline of blocked outbound traffic from AWS"]
 description = Monitor your AWS network infrastructure for bad configurations and malicious activity. Investigative searches help you probe deeper, when the facts warrant it.
 narrative = AWS CloudTrail is an AWS service that helps you enable governance, compliance, and operational/risk auditing of your AWS account. Actions taken by a user, role, or an AWS service are recorded as events in CloudTrail. It is crucial for a company to monitor events and actions taken in the AWS Management Console, AWS Command Line Interface, and AWS SDKs and APIs to ensure that your servers are not vulnerable to attacks. This analytic story contains detection searches that leverage CloudTrail logs from AWS to check for bad configurations and malicious activity in your AWS network access controls.
 
@@ -57,7 +57,7 @@ version = 1.0
 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
 maintainers = [{"company": "Splunk", "email": "davidd@splunk.com", "name": "David Dorsey"}]
 spec_version = 1
-searches = ["ESCU - AWS Cloud Provisioning From Previously Unseen Country - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen Region - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen City - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen IP Address - Rule", "ESCU - Get All AWS Activity From City", "ESCU - Get All AWS Activity From Country", "ESCU - Get All AWS Activity From Region", "ESCU - Get All AWS Activity From IP Address", "ESCU - Previously Seen AWS Provisioning Activity Sources", "ESCU - Get All AWS Activity From City", "ESCU - Get All AWS Activity From Country", "ESCU - Get All AWS Activity From Region", "ESCU - Get All AWS Activity From IP Address", "ESCU - Previously Seen AWS Provisioning Activity Sources", "ESCU - Get All AWS Activity From City", "ESCU - Get All AWS Activity From Country", "ESCU - Get All AWS Activity From Region", "ESCU - Get All AWS Activity From IP Address", "ESCU - Previously Seen AWS Provisioning Activity Sources", "ESCU - Get All AWS Activity From City", "ESCU - Get All AWS Activity From Country", "ESCU - Get All AWS Activity From Region", "ESCU - Get All AWS Activity From IP Address", "ESCU - Previously Seen AWS Provisioning Activity Sources"]
+searches = ["ESCU - AWS Cloud Provisioning From Previously Unseen Country - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen Region - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen City - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen IP Address - Rule", "ESCU - Get All AWS Activity From City", "ESCU - Get All AWS Activity From Country", "ESCU - Get All AWS Activity From IP Address", "ESCU - Get All AWS Activity From Region", "ESCU - Previously Seen AWS Provisioning Activity Sources"]
 description = Monitor your AWS provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your network.
 narrative = Because most enterprise AWS activities originate from familiar geographic locations, monitoring for activity from unknown or unusual regions is an important security measure. This indicator can be especially useful in environments where it is impossible to whitelist specific IPs (because they vary).\
 \
@@ -70,7 +70,7 @@ version = 1.0
 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://blog.redlock.io/cryptojacking-tesla"]
 maintainers = [{"company": "Splunk", "email": "bpatel@splunk.com", "name": "Bhavin Patel"}]
 spec_version = 1
-searches = ["ESCU - Detect AWS API Activities From Unapproved Accounts - Rule", "ESCU - Detect Spike in AWS API Activity - Rule", "ESCU - Detect new API calls from user roles - Rule", "ESCU - Detect Spike in Security Group Activity - Rule", "ESCU - Detect API activity from users without MFA - Rule", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Investigate AWS User Activities by user field", "ESCU - Create a list of approved AWS service accounts", "ESCU - Baseline of API Calls per User ARN", "ESCU - Previously seen API call per user roles in CloudTrail", "ESCU - Baseline of Security Group Activity by ARN", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Investigate AWS User Activities by user field", "ESCU - Create a list of approved AWS service accounts", "ESCU - Baseline of API Calls per User ARN", "ESCU - Previously seen API call per user roles in CloudTrail", "ESCU - Baseline of Security Group Activity by ARN", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Investigate AWS User Activities by user field", "ESCU - Create a list of approved AWS service accounts", "ESCU - Baseline of API Calls per User ARN", "ESCU - Previously seen API call per user roles in CloudTrail", "ESCU - Baseline of Security Group Activity by ARN", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Investigate AWS User Activities by user field", "ESCU - Create a list of approved AWS service accounts", "ESCU - Baseline of API Calls per User ARN", "ESCU - Previously seen API call per user roles in CloudTrail", "ESCU - Baseline of Security Group Activity by ARN", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Investigate AWS User Activities by user field", "ESCU - Create a list of approved AWS service accounts", "ESCU - Baseline of API Calls per User ARN", "ESCU - Previously seen API call per user roles in CloudTrail", "ESCU - Baseline of Security Group Activity by ARN"]
+searches = ["ESCU - Detect AWS API Activities From Unapproved Accounts - Rule", "ESCU - Detect Spike in AWS API Activity - Rule", "ESCU - Detect new API calls from user roles - Rule", "ESCU - Detect Spike in Security Group Activity - Rule", "ESCU - Detect API activity from users without MFA - Rule", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Investigate AWS User Activities by user field", "ESCU - Baseline of API Calls per User ARN", "ESCU - Baseline of Security Group Activity by ARN", "ESCU - Create a list of approved AWS service accounts", "ESCU - Previously seen API call per user roles in CloudTrail"]
 description = Detect and investigate dormant user accounts for your AWS environment that have become active again. Because inactive and ad-hoc accounts are common attack targets, it's critical to enable governance within your environment.
 narrative = It seems obvious that it is critical to monitor and control the users who have access to your cloud infrastructure. Nevertheless, it's all too common for enterprises to lose track of ad-hoc accounts, leaving their servers vulnerable to attack. In fact, this was the very oversight that led to Tesla's cryptojacking attack in February, 2018.\
 \
@@ -87,7 +87,7 @@ version = 1.0
 reference = ["https://www.sans.org/media/critical-security-controls/critical-controls-poster-2016.pdf"]
 maintainers = [{"company": "Splunk", "email": "bpatel@splunk.com", "name": "Bhavin Patel"}, {"company": "Splunk", "email": "davidd@splunk.com", "name": "David Dorsey"}]
 spec_version = 1
-searches = ["ESCU - Identify New User Accounts - Rule", "ESCU - Short Lived Windows Accounts - Rule", "ESCU - Detect Excessive Account Lockouts From Endpoint - Rule", "ESCU - Detect Excessive User Account Lockouts - Rule", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Logon Rights Modifications For User", "ESCU - Get Logon Rights Modifications For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Logon Rights Modifications For User", "ESCU - Get Logon Rights Modifications For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Logon Rights Modifications For User", "ESCU - Get Logon Rights Modifications For Endpoint"]
+searches = ["ESCU - Identify New User Accounts - Rule", "ESCU - Short Lived Windows Accounts - Rule", "ESCU - Detect Excessive Account Lockouts From Endpoint - Rule", "ESCU - Detect Excessive User Account Lockouts - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Logon Rights Modifications For Endpoint", "ESCU - Get Logon Rights Modifications For User", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table"]
 description = A common attack technique is to leverage user accounts to gain unauthorized access to the target's network. This Analytic Story minimizes opportunities for attack by helping you actively manage creation/use/dormancy/deletion--the lifecycle of system and application accounts.
 narrative = Monitoring user accounts within your enterprise is a critical analytic function that helps ensure that credential and access policies/procedures are properly implemented and are being enforced. Proactive ad-hoc hunting, as well as routine monitoring, can ensure user or system accounts are not being abused by unauthorized individuals or processes. In the event of a network event or breach, user-authentication logs are a key resource in determining if or how an account might have been compromised or co-opted, leading to suspicious or malicious activity.
 
@@ -98,7 +98,7 @@ version = 1.0
 reference = ["http://blog.talosintelligence.com/2017/03/apache-0-day-exploited.html", "https://github.com/SpiderLabs/owasp-modsecurity-crs/blob/v3.2/dev/rules/REQUEST-944-APPLICATION-ATTACK-JAVA.conf"]
 maintainers = [{"company": "Splunk", "email": "jhernandez@splunk.com", "name": "Jose Hernandez"}]
 spec_version = 1
-searches = ["ESCU - Unusually Long Content-Type Length - Rule", "ESCU - Web Servers Executing Suspicious Processes - Rule", "ESCU - Suspicious Java Classes - Rule", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Investigate Suspicious Strings in HTTP Header", "ESCU - Investigate Web POSTs From src", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Investigate Suspicious Strings in HTTP Header", "ESCU - Investigate Web POSTs From src", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Investigate Suspicious Strings in HTTP Header", "ESCU - Investigate Web POSTs From src"]
+searches = ["ESCU - Unusually Long Content-Type Length - Rule", "ESCU - Web Servers Executing Suspicious Processes - Rule", "ESCU - Suspicious Java Classes - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Investigate Suspicious Strings in HTTP Header", "ESCU - Investigate Web POSTs From src"]
 description = Detect and investigate activities--such as unusually long `Content-Type` length, suspicious java classes and web servers executing suspicious processes--consistent with attempts to exploit Apache Struts vulnerabilities.
 narrative = In March of 2017, a remote code-execution vulnerability in the Jakarta Multipart parser in Apache Struts, a widely used open-source framework for creating Java web applications, was disclosed and assigned to CVE-2017-5638. About two months later, hackers exploited the flaw to carry out the world's <a href=https://www.usatoday.com/story/tech/2017/09/07/nations-biggest-hacks-and-data-breaches-millions/644311001/> 5th largest data breach</a>. The target, credit giant Equifax, <a href=https://money.cnn.com/2017/09/16/technology/equifax-breach-security-hole/index.html>told investigators</a> that it had become aware of the vulnerability two months before the attack. \
 \
@@ -135,7 +135,7 @@ version = 1.0
 reference = ["https://www.cisecurity.org/controls/inventory-of-authorized-and-unauthorized-devices/"]
 maintainers = [{"company": "Splunk", "email": "bpatel@splunk.com", "name": "Bhavin Patel"}]
 spec_version = 1
-searches = ["ESCU - Detect Unauthorized Assets by MAC address - Rule", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get First Occurrence and Last Occurrence of a MAC Address", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Count of assets by category"]
+searches = ["ESCU - Detect Unauthorized Assets by MAC address - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get First Occurrence and Last Occurrence of a MAC Address", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Count of assets by category"]
 description = Keep a careful inventory of every asset on your network to make it easier to detect rogue devices. Unauthorized/unmanaged devices could be an indication of malicious behavior that should be investigated further.
 narrative = This Analytic Story is designed to help you develop a better understanding of what authorized and unauthorized devices are part of your enterprise. This story can help you better categorize and classify assets, providing critical business context and awareness of their assets during an incident. Information derived from this Analytic Story can be used to better inform and support other analytic stories. For successful detection, you will need to leverage the Assets and Identity Framework from Enterprise Security to populate your known assets.
 
@@ -146,7 +146,7 @@ version = 1.0
 reference = ["https://blog.domaintools.com/tag/brand-monitor/", "https://securingtomorrow.mcafee.com/consumer/family-safety/what-is-typosquatting/", "https://blog.malwarebytes.com/cybercrime/2016/06/explained-typosquatting/"]
 maintainers = [{"company": "Splunk", "email": "davidd@splunk.com", "name": "David Dorsey"}]
 spec_version = 1
-searches = ["ESCU - Monitor DNS For Brand Abuse - Rule", "ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Monitor Web Traffic For Brand Abuse - Rule", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Email Info", "ESCU - Get Emails From Specific Sender", "ESCU - Investigate Web Activity From Host", "ESCU - Get DNS Server History for a host", "ESCU - Get Process responsible for the DNS traffic", "ESCU - DNSTwist Domain Names", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Email Info", "ESCU - Get Emails From Specific Sender", "ESCU - Investigate Web Activity From Host", "ESCU - Get DNS Server History for a host", "ESCU - Get Process responsible for the DNS traffic", "ESCU - DNSTwist Domain Names", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Email Info", "ESCU - Get Emails From Specific Sender", "ESCU - Investigate Web Activity From Host", "ESCU - Get DNS Server History for a host", "ESCU - Get Process responsible for the DNS traffic", "ESCU - DNSTwist Domain Names"]
+searches = ["ESCU - Monitor DNS For Brand Abuse - Rule", "ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Monitor Web Traffic For Brand Abuse - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get DNS Server History for a host", "ESCU - Get Email Info", "ESCU - Get Emails From Specific Sender", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Process responsible for the DNS traffic", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Investigate Web Activity From Host", "ESCU - DNSTwist Domain Names"]
 description = Detect and investigate activity that may indicate that an adversary is using faux domains to mislead users into interacting with malicious infrastructure. Monitor DNS, email, and web traffic for permutations of your brand name.
 narrative = While you can educate your users and customers about the risks and threats posed by typosquatting, phishing, and corporate espionage, human error is a persistent fact of life. Of course, your adversaries are all too aware of this reality and will happily leverage it for nefarious purposes whenever possible&#51;phishing with lookalike addresses, embedding faux command-and-control domains in malware, and hosting malicious content on domains that closely mimic your corporate servers. This is where brand monitoring comes in.\
 \
@@ -161,7 +161,7 @@ version = 1.0
 reference = ["https://www.intego.com/mac-security-blog/osxcoldroot-and-the-rat-invasion/", "https://objective-see.com/blog/blog_0x2A.html", "https://www.bleepingcomputer.com/news/security/coldroot-rat-still-undetectable-despite-being-uploaded-on-github-two-years-ago/"]
 maintainers = [{"company": "Splunk", "email": "jhernandez@splunk.com", "name": "Jose Hernandez"}]
 spec_version = 1
-searches = ["ESCU - Processes Tapping Keyboard Events - Rule", "ESCU - Osquery pack - ColdRoot detection - Rule", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Investigate Network Traffic From src_ip", "ESCU - Investigate Web Activity From src_ip", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Investigate Network Traffic From src_ip", "ESCU - Investigate Web Activity From src_ip"]
+searches = ["ESCU - Processes Tapping Keyboard Events - Rule", "ESCU - Osquery pack - ColdRoot detection - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Investigate Network Traffic From src_ip", "ESCU - Investigate Web Activity From src_ip"]
 description = Leverage searches that allow you to detect and investigate unusual activities that relate to the ColdRoot Remote Access Trojan that affects MacOS. An example of some of these activities are changing sensative binaries in the MacOS sub-system, detecting process names and executables associated with the RAT, detecting when a keyboard tab is installed on a MacOS machine and more.
 narrative = Conventional wisdom holds that Apple's MacOS operating system is significantly less vulnerable to attack than Windows machines. While that point is debatable, it is true that attacks against MacOS systems are much less common. However, this fact does not mean that Macs are impervious to breaches. To the contrary, research has shown that that Mac malware is increasing at an alarming rate. According to AV-test, in 2018, there were 86,865 new MacOS malware variants, up from 27,338 the year before&#151;a 31% increase. In contrast, the independent research firm found that new Windows malware had increased from 65.17M to 76.86M during that same period, less than half the rate of growth. The bottom line is that while the numbers look a lot smaller than Windows, it's definitely time to take Mac security more seriously.\
 \
@@ -176,7 +176,7 @@ version = 1.0
 reference = ["https://attack.mitre.org/wiki/Collection", "https://attack.mitre.org/wiki/Technique/T1074"]
 maintainers = [{"company": "Splunk", "email": "rvaldez@splunk.com", "name": "Rico Valdez"}]
 spec_version = 1
-searches = ["ESCU - Suspicious writes to windows Recycle Bin - Rule", "ESCU - Suspicious writes to System Volume Information - Rule", "ESCU - Email files written outside of the Outlook directory - Rule", "ESCU - Hosts receiving high volume of network traffic from email server - Rule", "ESCU - Email servers sending high volume traffic to hosts - Rule", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info"]
+searches = ["ESCU - Suspicious writes to windows Recycle Bin - Rule", "ESCU - Suspicious writes to System Volume Information - Rule", "ESCU - Email files written outside of the Outlook directory - Rule", "ESCU - Hosts receiving high volume of network traffic from email server - Rule", "ESCU - Email servers sending high volume traffic to hosts - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table"]
 description = Monitor for and investigate activities--such as suspicious writes to the Windows Recycling Bin or email servers sending high amounts of traffic to specific hosts, for example--that may indicate that an adversary is harvesting and exfiltrating sensitive data.
 narrative = A common adversary goal is to identify and exfiltrate data of value from a target organization. This data may include email conversations and addresses, confidential company information, links to network design/infrastructure, important dates, and so on.\
 \
@@ -191,7 +191,7 @@ version = 1.0
 reference = ["https://attack.mitre.org/wiki/Command_and_Control", "https://searchsecurity.techtarget.com/feature/Command-and-control-servers-The-puppet-masters-that-govern-malware"]
 maintainers = [{"company": "Splunk", "email": "rvaldez@splunk.com", "name": "Rico Valdez"}]
 spec_version = 1
-searches = ["ESCU - Detect Large Outbound ICMP Packets - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - AWS Network Interface details via resourceId", "ESCU - Get Process Info", "ESCU - Get Process responsible for the DNS traffic", "ESCU - Get DNS Server History for a host", "ESCU - Get DNS traffic ratio", "ESCU - Get All AWS Activity From IP Address", "ESCU - Get Process Information For Port Activity", "ESCU - Baseline of blocked outbound traffic from AWS", "ESCU - Get Notable History", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Information For Port Activity", "ESCU - Count of Unique IPs Connecting to Ports", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get DNS Server History for a host", "ESCU - Get DNS traffic ratio", "ESCU - Get Process responsible for the DNS traffic", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Get Parent Process Info", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Get Parent Process Info", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes", "ESCU - Get DNS Server History for a host", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get DNS Server History for a host", "ESCU - Get DNS traffic ratio", "ESCU - Get Process responsible for the DNS traffic", "ESCU - Get DNS Server History for a host", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get DNS Server History for a host", "ESCU - Get DNS traffic ratio", "ESCU - Get Process responsible for the DNS traffic", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get DNS Server History for a host", "ESCU - Get DNS traffic ratio", "ESCU - Get Process responsible for the DNS traffic", "ESCU - Get DNS Server History for a host", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - AWS Network Interface details via resourceId", "ESCU - Get All AWS Activity From IP Address", "ESCU - Baseline of blocked outbound traffic from AWS"]
+searches = ["ESCU - Detect Large Outbound ICMP Packets - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - AWS Network Interface details via resourceId", "ESCU - Get All AWS Activity From IP Address", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get DNS Server History for a host", "ESCU - Get DNS traffic ratio", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Get Process responsible for the DNS traffic", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Baseline of blocked outbound traffic from AWS"]
 description = Detect and investigate tactics, techniques, and procedures leveraged by attackers to establish and operate command and control channels. Implants installed by attackers on compromised endpoints use these channels to receive instructions and send data back to the malicious operators.
 narrative = Threat actors typically architect and implement an infrastructure to use in various ways during the course of their attack campaigns. In some cases, they leverage this infrastructure for scanning and performing reconnaissance activities. In others, they may use this infrastructure to launch actual attacks. One of the most important functions of this infrastructure is to establish servers that will communicate with implants on compromised endpoints. These servers establish a command and control channel that is used to proxy data between the compromised endpoint and the attacker. These channels relay commands from the attacker to the compromised endpoint and the output of those commands back to the attacker.\
 \
@@ -215,7 +215,7 @@ version = 1.0
 reference = ["https://attack.mitre.org/wiki/Technique/T1003", "https://www.powershellempire.com/?page_id=112", "https://4iq.com/4iq-discovers-1-4-billion-clear-text-credentials-single-database/"]
 maintainers = [{"company": "Splunk", "email": "rvaldez@splunk.com", "name": "Rico Valdez"}]
 spec_version = 1
-searches = ["ESCU - Attempt To Set Default PowerShell Execution Policy To Unrestricted - Rule", "ESCU - Attempted Credential Dump From Registry Via Reg.exe - Rule", "ESCU - Detect Mimikatz Via PowerShell And EventCode 4703 - Rule", "ESCU - Detect Mimikatz Via PowerShell And EventCode 4663 - Rule", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Investigate Web Activity From Host", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Investigate Web Activity From Host", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Investigate Web Activity From Host"]
+searches = ["ESCU - Attempt To Set Default PowerShell Execution Policy To Unrestricted - Rule", "ESCU - Attempted Credential Dump From Registry Via Reg.exe - Rule", "ESCU - Detect Mimikatz Via PowerShell And EventCode 4703 - Rule", "ESCU - Detect Mimikatz Via PowerShell And EventCode 4663 - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Investigate Web Activity From Host"]
 description = Uncover activity consistent with credential dumping, a technique wherein attackers compromise systems and attempt to obtain and exfiltrate passwords. The threat actors use these pilfered credentials to further escalate privileges and spread throughout a target environment. The included searches in this Analytic Story are designed to identify attmpts to dump credentials.
 narrative = Credential dumping&#151;gathering credentials from a target system, often hashed or encrypted&#151;is a common attack technique. Even though the credentials may not be in plain text, an attacker can still exfiltrate the data and set to cracking it offline, on their own systems. The threat actors target a variety of sources to extract them, including the Security Accounts Manager (SAM), Local Security Authority (LSA), NTDS from Domain Controllers, or the Group Policy Preference (GPP) files.\
 \
@@ -230,7 +230,7 @@ version = 2.0
 reference = ["https://www.us-cert.gov/ncas/alerts/TA18-074A"]
 maintainers = [{"company": "Splunk", "email": "rvaldez@splunk.com", "name": "Rico Valdez"}]
 spec_version = 1
-searches = ["ESCU - SMB Traffic Spike - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Suspicious Reg.exe Process - Rule", "ESCU - Sc.exe Manipulating Windows Services - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Create local admin accounts using net.exe - Rule", "ESCU - Single Letter Process On Endpoint - Rule", "ESCU - Scheduled Task Name Used by Dragonfly Threat Actors - Rule", "ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Detect New Local Admin account - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Get Parent Process Info", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Investigate Web Activity From Host", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Previously Seen Running Windows Services", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Previously seen command line arguments", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Previously seen command line arguments", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Previously seen command line arguments", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Previously seen command line arguments", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Outbound Emails to Hidden Cobra Threat Actors", "ESCU - Previously seen command line arguments", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Previously seen command line arguments", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Get Parent Process Info", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes", "ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Investigate Web Activity From Host", "ESCU - Previously seen command line arguments"]
+searches = ["ESCU - SMB Traffic Spike - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Suspicious Reg.exe Process - Rule", "ESCU - Sc.exe Manipulating Windows Services - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Create local admin accounts using net.exe - Rule", "ESCU - Single Letter Process On Endpoint - Rule", "ESCU - Scheduled Task Name Used by Dragonfly Threat Actors - Rule", "ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Detect New Local Admin account - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Previously seen command line arguments"]
 description = Monitor for suspicious activities associated with DHS Technical Alert US-CERT TA18-074A. Some of the activities that adversaries used in these compromises included spearfishing attacks, malware, watering-hole domains, many and more.
 narrative = The frequency of nation-state cyber attacks has increased significantly over the last decade. Employing numerous tactics and techniques, these attacks continue to escalate in complexity. \
 \
@@ -247,7 +247,7 @@ version = 1.0
 reference = ["https://www.us-cert.gov/ncas/alerts/TA13-088A", "https://deepthought.isc.org/article/AA-00897/0/What-is-a-DNS-Amplification-Attack.html"]
 maintainers = [{"company": "Splunk", "email": "bpatel@splunk.com", "name": "Bhavin Patel"}]
 spec_version = 1
-searches = ["ESCU - Large Volume of DNS ANY Queries - Rule", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint"]
+searches = ["ESCU - Large Volume of DNS ANY Queries - Rule", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User"]
 description = DNS poses a serious threat as a Denial of Service (DOS) amplifier, if it responds to `ANY` queries. This Analytic Story can help you detect attackers who may be abusing your company's DNS infrastructure to launch amplification attacks, causing Denial of Service to other victims.
 narrative = The Domain Name System (DNS) is the protocol used to map domain names to IP addresses. It has been proven to work very well for its intended function. However if DNS is misconfigured, servers can be abused by attackers to levy amplification or redirection attacks against victims. Because DNS responses to `ANY` queries are so much larger than the queries themselves--and can be made with a UDP packet, which does not require a handshake--attackers can spoof the source address of the packet and cause much more data to be sent to the victim than if they sent the traffic themselves. The `ANY` requests are will be larger than normal DNS server requests, due to the fact that the server provides significant details, such as MX records and associated IP addresses. A large volume of this traffic can result in a DOS on the victim's machine. This misconfiguration leads to two possible victims, the first being the DNS servers participating in an attack and the other being the hosts that are the targets of the DOS attack.\
 \
@@ -260,7 +260,7 @@ version = 1.0
 reference = ["https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html", "https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/", "http://www.noip.com/blog/2014/07/11/dynamic-dns-can-use-2/", "https://www.splunk.com/blog/2015/08/04/detecting-dynamic-dns-domains-in-splunk.html"]
 maintainers = [{"company": "Splunk", "email": "bpatel@splunk.com", "name": "Bhavin Patel"}]
 spec_version = 2
-searches = ["ESCU - DNS record changed - Rule", "ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Get DNS Server History for a host", "ESCU - Discover DNS records", "ESCU - Get DNS Server History for a host", "ESCU - Get DNS Server History for a host", "ESCU - Get DNS Server History for a host"]
+searches = ["ESCU - DNS record changed - Rule", "ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Discover DNS records"]
 description = Secure your environment against DNS hijacks with searches that help you detect and investigate unauthorized changes to DNS records.
 narrative = Dubbed the Achilles heel of the Internet (see https://www.f5.com/labs/articles/threat-intelligence/dns-is-still-the-achilles-heel-of-the-internet-25613), DNS plays a critical role in routing web traffic but is notoriously vulnerable to attack. One reason is its distributed nature. It relies on unstructured connections between millions of clients and servers over inherently insecure protocols.\
 \
@@ -287,7 +287,7 @@ version = 1.0
 reference = ["https://www.cisecurity.org/controls/data-protection/", "https://www.sans.org/reading-room/whitepapers/dns/splunk-detect-dns-tunneling-37022", "https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/"]
 maintainers = [{"company": "Splunk", "email": "bpatel@splunk.com", "name": "Bhavin Patel"}]
 spec_version = 1
-searches = ["ESCU - Detection of DNS Tunnels - Rule", "ESCU - Detect USB device insertion - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get DNS Server History for a host", "ESCU - Get DNS traffic ratio", "ESCU - Get Process responsible for the DNS traffic", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get DNS Server History for a host", "ESCU - Get Process responsible for the DNS traffic", "ESCU - Get DNS Server History for a host"]
+searches = ["ESCU - Detection of DNS Tunnels - Rule", "ESCU - Detect USB device insertion - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get DNS Server History for a host", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Process responsible for the DNS traffic", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table"]
 description = Fortify your data-protection arsenal--while continuing to ensure data confidentiality and integrity--with searches that monitor for and help you investigate possible signs of data exfiltration.
 narrative = Attackers can leverage a variety of resources to compromise or exfiltrate enterprise data. Common exfiltration techniques include remote-access channels via low-risk, high-payoff active-collections operations and close-access operations using insiders and removable media. While this Analytic Story is not a comprehensive listing of all the methods by which attackers can exfiltrate data, it provides a useful starting point.
 
@@ -298,7 +298,7 @@ version = 1.0
 reference = ["https://attack.mitre.org/wiki/Technique/T1089", "https://blog.malwarebytes.com/cybercrime/2015/11/vonteera-adware-uses-certificates-to-disable-anti-malware/", "https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Tools-Report.pdf"]
 maintainers = [{"company": "Splunk", "email": "rvaldez@splunk.com", "name": "Rico Valdez"}]
 spec_version = 1
-searches = ["ESCU - Sc.exe Manipulating Windows Services - Rule", "ESCU - Suspicious Reg.exe Process - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Attempt To Stop Security Service - Rule", "ESCU - Attempt To Add Certificate To Untrusted Store - Rule", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Previously Seen Running Windows Services", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Investigate Web Activity From Host", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info"]
+searches = ["ESCU - Sc.exe Manipulating Windows Services - Rule", "ESCU - Suspicious Reg.exe Process - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Attempt To Stop Security Service - Rule", "ESCU - Attempt To Add Certificate To Untrusted Store - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table"]
 description = Looks for activities and techniques associated with the disabling of security tools on a Windows system, such as suspicious `reg.exe` processes, processes launching netsh, and many others.
 narrative = Attackers employ a variety of tactics in order to avoid detection and operate without barriers. This often involves modifying the configuration of security tools to get around them or explicitly disabling them to prevent them from running. This Analytic Story includes searches that look for activity consistent with attackers attempting to disable various security mechanisms. Such activity may involve monitoring for suspicious registry activity, as this is where much of the configuration for Windows and various other programs reside, or explicitly attempting to shut down security-related services. Other times, attackers attempt various tricks to prevent specific programs from running, such as adding the certificates with which the security tools are signed to a blacklist (which would prevent them from running).
 
@@ -309,7 +309,7 @@ version = 2.0
 reference = ["https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html", "https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/", "http://www.noip.com/blog/2014/07/11/dynamic-dns-can-use-2/", "https://www.splunk.com/blog/2015/08/04/detecting-dynamic-dns-domains-in-splunk.html"]
 maintainers = [{"company": "Splunk", "email": "bpatel@splunk.com", "name": "Bhavin Patel"}]
 spec_version = 1
-searches = ["ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detect web traffic to dynamic domain providers - Rule", "ESCU - Get DNS Server History for a host", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get DNS Server History for a host", "ESCU - Get DNS traffic ratio", "ESCU - Get Process responsible for the DNS traffic", "ESCU - Investigate Web Activity From src_ip"]
+searches = ["ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detect web traffic to dynamic domain providers - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get DNS Server History for a host", "ESCU - Get DNS traffic ratio", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Process responsible for the DNS traffic", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Investigate Web Activity From src_ip"]
 description = Detect and investigate hosts in your environment that may be communicating with dynamic domain providers. Attackers may leverage these services to help them avoid firewall blocks and blacklists.
 narrative = Dynamic DNS services (DDNS) are legitimate low-cost or free services that allow users to rapidly update domain resolutions to IP infrastructure. While their usage can be benign, malicious actors can abuse DDNS to host harmful payloads or interactive-command-and-control infrastructure. These attackers will manually update or automate domain resolution changes by routing dynamic domains to IP addresses that circumvent firewall blocks and blacklists and frustrate a network defender's analytic and investigative processes. These searches will look for DNS queries made from within your infrastructure to suspicious dynamic domains and then investigate more deeply, when appropriate. While this list of top-level dynamic domains is not exhaustive, it can be dynamically updated as new suspicious dynamic domains are identified.
 
@@ -320,7 +320,7 @@ version = 1.0
 reference = ["https://www.us-cert.gov/ncas/alerts/TA18-201A", "https://www.first.org/resources/papers/conf2017/Advanced-Incident-Detection-and-Threat-Hunting-using-Sysmon-and-Splunk.pdf", "https://www.vkremez.com/2017/05/emotet-banking-trojan-malware-analysis.html"]
 maintainers = [{"company": "Splunk", "email": "bpatel@splunk.com", "name": "Bhavin Patel"}]
 spec_version = 1
-searches = ["ESCU - Detect Rare Executables - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Detect Use of cmd.exe to Launch Script Interpreters - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule", "ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Detection of tools built by NirSoft - Rule", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Investigate Web Activity From Host", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Investigate Web Activity From Host", "ESCU - Previously seen command line arguments", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Get Parent Process Info", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes", "ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Get Parent Process Info", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Email Info", "ESCU - Get Emails From Specific Sender", "ESCU - Investigate Web Activity From Host", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Email Info", "ESCU - Get Emails From Specific Sender", "ESCU - Investigate Web Activity From Host", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Investigate Web Activity From Host"]
+searches = ["ESCU - Detect Rare Executables - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Detect Use of cmd.exe to Launch Script Interpreters - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule", "ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Detection of tools built by NirSoft - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Investigate Web Activity From Host"]
 description = Detect rarely used executables, specific registry paths that may confer malware survivability and persistence, instances where cmd.exe is used to launch script interpreters, and other indicators that the Emotet financial malware has compromised your environment.
 narrative = The trojan downloader known as Emotet first surfaced in 2014, when it was discovered targeting the banking industry to steal credentials. However, according to a joint technical alert (TA) issued by three government agencies (https://www.us-cert.gov/ncas/alerts/TA18-201A), Emotet has evolved far beyond those beginnings to become what a ThreatPost article called a threat-delivery service(see https://threatpost.com/emotet-malware-evolves-beyond-banking-to-threat-delivery-service/134342/).  For example, in early 2018, Emotet was found to be using its loader function to spread the Quakbot and Ransomware variants. \
 \
@@ -335,7 +335,7 @@ version = 2.0
 reference = ["https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity", "https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf"]
 maintainers = [{"company": "Splunk", "email": "rvaldez@splunk.com", "name": "Rico Valdez"}]
 spec_version = 1
-searches = ["ESCU - SMB Traffic Spike - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - Create or delete hidden shares using net.exe - Rule", "ESCU - Suspicious File Write - Rule", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Get Parent Process Info", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Investigate Web Activity From Host", "ESCU - Previously seen command line arguments", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Outbound Emails to Hidden Cobra Threat Actors", "ESCU - Previously seen command line arguments", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Get Parent Process Info", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes", "ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Identify Systems Using Remote Desktop", "ESCU - Identify Systems Creating Remote Desktop Traffic", "ESCU - Identify Systems Receiving Remote Desktop Traffic", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get DNS Server History for a host", "ESCU - Get DNS traffic ratio", "ESCU - Get Process responsible for the DNS traffic", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Outbound Emails to Hidden Cobra Threat Actors", "ESCU - Previously seen command line arguments", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Outbound Emails to Hidden Cobra Threat Actors", "ESCU - Previously seen command line arguments"]
+searches = ["ESCU - SMB Traffic Spike - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - Create or delete hidden shares using net.exe - Rule", "ESCU - Suspicious File Write - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Outbound Emails to Hidden Cobra Threat Actors", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Previously seen command line arguments"]
 description = Monitor for and investigate activities, including the creation or deletion of hidden shares and file writes, that may be evidence of infiltration by North Korean government-sponsored cybercriminals. Details of this activity were reported in DHS Report TA-18-149A.
 narrative = North Korea's government-sponsored "cyber army" has been slowly building momentum and gaining sophistication over the last 15 years or so. As a result, the group's activity, which the US government refers to as "Hidden Cobra," has surreptitiously crept onto the collective radar as a preeminent global threat.\
 \
@@ -352,7 +352,7 @@ version = 1.0
 reference = ["https://blog.malwarebytes.com/cybercrime/2016/09/hosts-file-hijacks/"]
 maintainers = [{"company": "Splunk", "email": "rvaldez@splunk.com", "name": "Rico Valdez"}]
 spec_version = 1
-searches = ["ESCU - Windows hosts file modification - Rule", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Investigate Web Activity From Host", "ESCU - Get DNS Server History for a host", "ESCU - Get Process responsible for the DNS traffic"]
+searches = ["ESCU - Windows hosts file modification - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get DNS Server History for a host", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Process responsible for the DNS traffic", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Investigate Web Activity From Host"]
 description = Detect evidence of tactics used to redirect traffic from a host to a destination other than the one intended--potentially one that is part of an adversary's attack infrastructure. An example is redirecting communications regarding patches and updates or misleading users into visiting a malicious website.
 narrative = Attackers will often attempt to manipulate client communications for nefarious purposes. In some cases, an attacker may endeavor to modify a local host file to redirect communications with resources (such as antivirus or system-update services) to prevent clients from receiving patches or updates. In other cases, an attacker might use this tactic to have the client connect to a site that looks like the intended site, but instead installs malware or collects information from the victim. Additionally, an attacker may redirect a victim in order to execute a MITM attack and observe communications.
 
@@ -363,7 +363,7 @@ version = 1.0
 reference = ["http://www.deependresearch.org/2016/04/jboss-exploits-view-from-victim.html"]
 maintainers = [{"company": "Splunk", "email": "bpatel@splunk.com", "name": "Bhavin Patel"}]
 spec_version = 1
-searches = ["ESCU - Detect malicious requests to exploit JBoss servers - Rule", "ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Get Parent Process Info", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes", "ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Get Parent Process Info", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes", "ESCU - Add Prohibited Processes to Enterprise Security"]
+searches = ["ESCU - Detect malicious requests to exploit JBoss servers - Rule", "ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table"]
 description = In March of 2016, adversaries were seen using JexBoss--an open-source utility used for testing and exploiting JBoss application servers. These searches help detect evidence of these attacks, such as network connections to external resources or web services spawning atypical child processes, among others.
 narrative = This Analytic Story looks for probing and exploitation attempts targeting JBoss application servers. While the vulnerabilities associated with this story are rather dated, they were leveraged in a spring 2016 campaign in connection with the Samsam ransomware variant. Incidents involving this ransomware are unique, in that they begin with attacks against vulnerable services, rather than the phishing or drive-by attacks more common with ransomware. In this case, vulnerable JBoss applications appear to be the target of choice.\
 \
@@ -402,7 +402,7 @@ version = 1.0
 reference = ["https://www.binarydefense.com/bds/reliably-detecting-pass-the-hash-through-event-log-analysis/", "https://www.fireeye.com/blog/executive-perspective/2015/08/malware_lateral_move.html"]
 maintainers = [{"company": "Splunk", "email": "davidd@splunk.com", "name": "David Dorsey"}]
 spec_version = 1
-searches = ["ESCU - Schtasks scheduling job on remote system - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Detect Activity Related to Pass the Hash Attacks - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Identify Systems Using Remote Desktop", "ESCU - Identify Systems Creating Remote Desktop Traffic", "ESCU - Identify Systems Receiving Remote Desktop Traffic", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Identify Systems Using Remote Desktop", "ESCU - Identify Systems Creating Remote Desktop Traffic", "ESCU - Identify Systems Receiving Remote Desktop Traffic", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Get Parent Process Info", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes", "ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Identify Systems Using Remote Desktop", "ESCU - Identify Systems Creating Remote Desktop Traffic", "ESCU - Identify Systems Receiving Remote Desktop Traffic", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info"]
+searches = ["ESCU - Schtasks scheduling job on remote system - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Detect Activity Related to Pass the Hash Attacks - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Identify Systems Creating Remote Desktop Traffic", "ESCU - Identify Systems Receiving Remote Desktop Traffic", "ESCU - Identify Systems Using Remote Desktop"]
 description = Detect and investigate tactics, techniques, and procedures around how attackers move laterally within the enterprise. Because lateral movement can expose the adversary to detection, it should be an important focus for security analysts.
 narrative = Once attackers gain a foothold within an enterprise, they will seek to expand their accesses and leverage techniques that facilitate lateral movement. Attackers will often spend quite a bit of time and effort moving laterally. Because lateral movement renders an attacker the most vulnerable to detection, it's an excellent focus for detection and investigation.\
 \
@@ -421,7 +421,7 @@ version = 4.0
 reference = ["https://blogs.mcafee.com/mcafee-labs/malware-employs-powershell-to-infect-systems/", "https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"]
 maintainers = [{"company": "Splunk", "email": "davidd@splunk.com", "name": "David Dorsey"}]
 spec_version = 1
-searches = ["ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments - Rule", "ESCU - Malicious PowerShell Process With Obfuscation Techniques - Rule", "ESCU - Attempt To Set Default PowerShell Execution Policy To Unrestricted - Rule", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Previously seen command line arguments", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info"]
+searches = ["ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments - Rule", "ESCU - Malicious PowerShell Process With Obfuscation Techniques - Rule", "ESCU - Attempt To Set Default PowerShell Execution Policy To Unrestricted - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table"]
 description = Attackers are finding stealthy ways "live off the land," leveraging utilities and tools that come standard on the endpoint--such as PowerShell--to achieve their goals without downloading binary files. These searches can help you detect and investigate PowerShell command-line options that may be indicative of malicious intent.
 narrative = The searches in this Analytic Story monitor for parameters often used for malicious purposes. It is helpful to understand how often the notable events generated by this story occur, as well as the commonalities between some of these events. These factors may provide clues about whether this is a common occurrence of minimal concern or a rare event that may require more extensive investigation. Likewise, it is important to determine whether the issue is restricted to a single user/system or is broader in scope.\
 \
@@ -450,7 +450,7 @@ version = 1.0
 reference = ["https://www.carbonblack.com/2016/03/04/tracking-locky-ransomware-using-carbon-black/"]
 maintainers = [{"company": "Splunk", "email": "davidd@splunk.com", "name": "David Dorsey"}]
 spec_version = 1
-searches = ["ESCU - Unsuccessful Netbackup backups - Rule", "ESCU - Extended Period Without Successful Netbackup Backups - Rule", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - All backup logs for host", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - All backup logs for host", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups"]
+searches = ["ESCU - Unsuccessful Netbackup backups - Rule", "ESCU - Extended Period Without Successful Netbackup Backups - Rule", "ESCU - All backup logs for host", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups"]
 description = Address common concerns when monitoring your backup processes. These searches can help you reduce risks from ransomware, device theft, or denial of physical access to a host by backing up data on endpoints.
 narrative = Having backups is a standard best practice that helps ensure continuity of business operations.  Having mature backup processes can also help you reduce the risks of many security-related incidents and streamline your response processes. The detection searches in this Analytic Story will help you identify systems that have backup failures, as well as systems that have not been backed up for an extended period of time. The story will also return the notable event history and all of the backup logs for an endpoint.
 
@@ -461,7 +461,7 @@ version = 1.0
 reference = ["https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"]
 maintainers = [{"company": "Splunk", "email": "davidd@splunk.com", "name": "David Dorsey"}]
 spec_version = 1
-searches = ["ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Get Parent Process Info", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes", "ESCU - Add Prohibited Processes to Enterprise Security"]
+searches = ["ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Investigate Web Activity From Host", "ESCU - Add Prohibited Processes to Enterprise Security"]
 description = Identify and investigate prohibited/unauthorized software or processes that may be concealing malicious behavior within your environment.
 narrative = It is critical to identify unauthorized software and processes running on enterprise endpoints and determine whether they are likely to be malicious. This Analytic Story requires the user to populate the Interesting Processes table within Enterprise Security with prohibited processes. An included support search will augment this data, adding information on processes thought to be malicious. This search requires data from endpoint detection-and-response solutions, endpoint data sources (such as Sysmon), or Windows Event Logs--assuming that the Active Directory administrator has enabled process tracking within the System Event Audit Logs.\
 \
@@ -474,7 +474,7 @@ version = 1.0
 reference = ["https://learn.cisecurity.org/20-controls-download"]
 maintainers = [{"company": "Splunk", "email": "rvaldez@splunk.com", "name": "Rico Valdez"}]
 spec_version = 1
-searches = ["ESCU - No Windows Updates in a time frame - Rule", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint"]
+searches = ["ESCU - No Windows Updates in a time frame - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table"]
 description = Monitor your enterprise to ensure that your endpoints are being patched and updated. Adversaries notoriously exploit known vulnerabilities that could be mitigated by applying routine security patches.
 narrative = It is a common best practice to ensure that endpoints are being patched and updated in a timely manner, in order to reduce the risk of compromise via a publicly disclosed vulnerability. Timely application of updates/patches is important to eliminate known vulnerabilities that may be exploited by various threat actors.\
 \
@@ -489,7 +489,7 @@ version = 1.0
 reference = ["https://technet.microsoft.com/library/bb490939.aspx", "https://htmlpreview.github.io/?https://github.com/MatthewDemaske/blogbackup/blob/master/netshell.html", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html"]
 maintainers = [{"company": "Splunk", "email": "bpatel@splunk.com", "name": "Bhavin Patel"}]
 spec_version = 1
-searches = ["ESCU - Processes created by netsh - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Investigate Web Activity From Host", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Investigate Web Activity From Host"]
+searches = ["ESCU - Processes created by netsh - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Investigate Web Activity From Host"]
 description = Detect activities and various techniques associated with the abuse of `netsh.exe`, which can disable local firewall settings or set up a remote connection to a host from an infected system.
 narrative = It is a common practice for attackers of all types to leverage native Windows tools and functionality to execute commands for malicious reasons. One such tool on Windows OS is `netsh.exe`,a command-line scripting utility that allows you to--either locally or remotely--display or modify the network configuration of a computer that is currently running. `Netsh.exe` can be used to discover and disable local firewall settings. It can also be used to set up a remote connection to a host from an infected system.\
 \
@@ -502,7 +502,7 @@ version = 2.0
 reference = ["https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia", "https://www.infosecurity-magazine.com/news/healthcare-targeted-by-hacker/"]
 maintainers = [{"company": "Splunk", "email": "davidd@splunk.com", "name": "David Dorsey"}]
 spec_version = 1
-searches = ["ESCU - First time seen command line argument - Rule", "ESCU - Sc.exe Manipulating Windows Services - Rule", "ESCU - First Time Seen Running Windows Service - Rule", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Investigate Web Activity From Host", "ESCU - Previously seen command line arguments", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Previously Seen Running Windows Services", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Previously Seen Running Windows Services"]
+searches = ["ESCU - First time seen command line argument - Rule", "ESCU - Sc.exe Manipulating Windows Services - Rule", "ESCU - First Time Seen Running Windows Service - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Investigate Web Activity From Host", "ESCU - Previously Seen Running Windows Services", "ESCU - Previously seen command line arguments"]
 description = Detect activities and various techniques associated with the Orangeworm Attack Group, a group that frequently targets the healthcare industry.
 narrative = In May of 2018, the attack group Orangeworm was implicated for installing a custom backdoor called Trojan.Kwampirs within large international healthcare corporations in the United States, Europe, and Asia. This malware provides the attackers with remote access to the target system, decrypting and extracting a copy of its main DLL payload from its resource section. Before writing the payload to disk, it inserts a randomly generated string into the middle of the decrypted payload in an attempt to evade hash-based detections.\
 \
@@ -532,7 +532,7 @@ version = 1.0
 reference = ["https://intelgraph.idefense.com/#/node/threat_group/view/29fbec10-8cc8-4662-8362-2c24c1eeb74c", "https://intelgraph.idefense.com/#/node/intelligence_alert/view/62bb3669-9386-4264-b51a-59876cf50ffe", "http://blog.amossys.fr/badflick-is-not-so-bad.html"]
 maintainers = [{"company": "iDefense", "email": "iDefense.IntelOps@accenture.com", "name": "iDefense Cyber Espionage Team"}]
 spec_version = 1
-searches = ["ESCU - First time seen command line argument - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Investigate Web Activity From Host", "ESCU - Previously seen command line arguments", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Previously seen command line arguments", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Investigate Web Activity From Host"]
+searches = ["ESCU - First time seen command line argument - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Previously seen command line arguments"]
 description = Monitor your environment for suspicious behaviors that resemble the techniques employed by the MUDCARP threat group.
 narrative = This story was created as a joint effort between iDefense and Splunk.\
 \
@@ -597,7 +597,7 @@ version = 1.0
 reference = ["http://www.novetta.com/2015/02/advanced-methods-to-detect-advanced-cyber-attacks-protocol-abuse/"]
 maintainers = [{"company": "Splunk", "email": "rvaldez@splunk.com", "name": "Rico Valdez"}]
 spec_version = 1
-searches = ["ESCU - TOR Traffic - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Get Parent Process Info", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Get Parent Process Info", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes", "ESCU - Get Notable History", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Information For Port Activity", "ESCU - Count of Unique IPs Connecting to Ports", "ESCU - Get DNS Server History for a host"]
+searches = ["ESCU - TOR Traffic - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Process Information For Port Activity", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Count of Unique IPs Connecting to Ports"]
 description = Detect instances of prohibited network traffic allowed in the environment, as well as protocols running on non-standard ports. Both of these types of behaviors typically violate policy and can be leveraged by attackers.
 narrative = A traditional security best practice is to control the ports, protocols, and services allowed within your environment. By limiting the services and protocols to those explicitly approved by policy, administrators can minimize the attack surface. The combined effect allows both network defenders and security controls to focus and not be mired in superfluous traffic or data types. Looking for deviations to policy can identify attacker activity that abuses services and protocols to run on alternate or non-standard ports in the attempt to avoid detection or frustrate forensic analysts.
 
@@ -608,7 +608,7 @@ version = 1.0
 reference = ["https://www.symantec.com/connect/blogs/what-you-need-know-about-wannacry-ransomware", "https://www.carbonblack.com/2017/06/28/carbon-black-threat-research-technical-analysis-petya-notpetya-ransomware/", "https://www.splunk.com/blog/2017/06/27/closing-the-detection-to-mitigation-gap-or-to-petya-or-notpetya-whocares-.html"]
 maintainers = [{"company": "Splunk", "email": "davidd@splunk.com", "name": "David Dorsey"}]
 spec_version = 1
-searches = ["ESCU - Windows Event Log Cleared - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Get Parent Process Info", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes", "ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Get Parent Process Info", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Get Parent Process Info", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Get Parent Process Info", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes", "ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Get Parent Process Info", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes", "ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Investigate Web Activity From Host", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Sysmon WMI Activity for Host", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Get Parent Process Info", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Investigate Web Activity From Host", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Get Parent Process Info", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info"]
+searches = ["ESCU - Windows Event Log Cleared - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Update Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Investigate Web Activity From Host", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes"]
 description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware--spikes in SMB traffic, suspicious wevtutil usage, the presence of common ransomware extensions, and system processes run from unexpected locations, and many others.
 narrative = Ransomware is an ever-present risk to the enterprise, wherein an infected host encrypts business-critical data, holding it hostage until the victim pays the attacker a ransom. There are many types and varieties of ransomware that can affect an enterprise. Attackers can deploy ransomware to enterprises through spearphishing campaigns and driveby downloads, as well as through traditional remote service-based exploitation. In the case of the WannaCry campaign, there was self-propagating wormable functionality that was used to maximize infection. Fortunately, organizations can apply several techniques--such as those in this Analytic Story--to detect and or mitigate the effects of ransomware.
 
@@ -619,7 +619,7 @@ version = 1.0
 reference = ["https://www.fireeye.com/blog/executive-perspective/2015/09/the_new_route_toper.html", "https://www.cisco.com/c/en/us/about/security-center/event-response/synful-knock.html"]
 maintainers = [{"company": "Splunk", "email": "bpatel@splunk.com", "name": "Bhavin Patel"}]
 spec_version = 1
-searches = ["ESCU - Detect New Login Attempts to Routers - Rule", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint"]
+searches = ["ESCU - Detect New Login Attempts to Routers - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table"]
 description = Validate the security configuration of network infrastructure and verify that only authorized users and systems are accessing critical assets. Core routing and switching infrastructure are common strategic targets for attackers.
 narrative = Networking devices, such as routers and switches, are often overlooked as resources that attackers will leverage to subvert an enterprise. Advanced threats actors have shown a proclivity to target these critical assets as a means to siphon and redirect network traffic, flash backdoored operating systems, and implement cryptographic weakened algorithms to more easily decrypt network traffic.\
 \
@@ -632,7 +632,7 @@ version = 1.0
 reference = ["https://www.owasp.org/index.php/SQL_Injection", "https://www.owasp.org/index.php/Blind_SQL_Injection", "https://www.incapsula.com/web-application-security/sql-injection.html"]
 maintainers = [{"company": "Splunk", "email": "bpatel@splunk.com", "name": "Bhavin Patel"}]
 spec_version = 1
-searches = ["ESCU - SQL Injection with Long URLs - Rule", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint"]
+searches = ["ESCU - SQL Injection with Long URLs - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table"]
 description = Use the searches in this Analytic Story to help you detect structured query language (SQL) injection attempts characterized by long URLs that contain malicious parameters.
 narrative = It is very common for attackers to inject SQL parameters into vulnerable web applications, which then interpret the malicious SQL statements.\
 \
@@ -645,7 +645,7 @@ version = 1.0
 reference = ["https://www.crowdstrike.com/blog/an-in-depth-analysis-of-samsam-ransomware-and-boss-spider/", "https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/SamSam-ransomware-chooses-Its-targets-carefully-wpna.pdf", "https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/SamSam-The-Almost-Six-Million-Dollar-Ransomware.pdf?cmp=26061"]
 maintainers = [{"company": "Splunk", "email": "rvaldez@splunk.com", "name": "Rico Valdez"}]
 spec_version = 1
-searches = ["ESCU - Deleting Shadow Copies - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule", "ESCU - Detect malicious requests to exploit JBoss servers - Rule", "ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - File with Samsam Extension - Rule", "ESCU - Samsam Test File Write - Rule", "ESCU - Batch File Write to System32 - Rule", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Get Parent Process Info", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes", "ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Get Parent Process Info", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes", "ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Get Parent Process Info", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes", "ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Get Parent Process Info", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes", "ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Get Parent Process Info", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes", "ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Get Parent Process Info", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes", "ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Get Parent Process Info", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes", "ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Get Parent Process Info", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes", "ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Get Parent Process Info", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes", "ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Get Parent Process Info", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes", "ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Get Parent Process Info", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes", "ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Get Parent Process Info", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes", "ESCU - Add Prohibited Processes to Enterprise Security"]
+searches = ["ESCU - Deleting Shadow Copies - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule", "ESCU - Detect malicious requests to exploit JBoss servers - Rule", "ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - File with Samsam Extension - Rule", "ESCU - Samsam Test File Write - Rule", "ESCU - Batch File Write to System32 - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Update Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Investigate Web Activity From Host", "ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes"]
 description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the SamSam ransomware, including looking for file writes associated with SamSam, RDP brute force attacks, the presence of files with SamSam ransomware extensions, suspicious psexec use, and more.
 narrative = The first version of the SamSam ransomware (a.k.a. Samas or SamsamCrypt) was launched in 2015 by a group of Iranian threat actors. The malicious software has affected and continues to affect thousands of victims and has raised almost $6M in ransom.\
 \
@@ -666,7 +666,7 @@ version = 1.0
 reference = ["https://meltdownattack.com/"]
 maintainers = [{"company": "Splunk", "email": "davidd@splunk.com", "name": "David Dorsey"}]
 spec_version = 1
-searches = ["ESCU - Spectre and Meltdown Vulnerable Systems - Rule", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Systems Ready for Spectre-Meltdown Windows Patch"]
+searches = ["ESCU - Spectre and Meltdown Vulnerable Systems - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Systems Ready for Spectre-Meltdown Windows Patch"]
 description = Assess and mitigate your systems' vulnerability to Spectre and Meltdown exploitation with the searches in this Analytic Story.
 narrative = Meltdown and Spectre exploit critical vulnerabilities in modern CPUs that allow unintended access to data in memory. This Analytic Story will help you identify the systems can be patched for these vulnerabilities, as well as those that still need to be patched.
 
@@ -677,7 +677,7 @@ version = 1.0
 reference = ["http://www.splunk.com/view/SP-CAAAPQ6#announce", "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4859"]
 maintainers = [{"company": "Splunk", "email": "bpatel@splunk.com", "name": "Bhavin Patel"}]
 spec_version = 1
-searches = ["ESCU - Open Redirect in Splunk Web - Rule", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint"]
+searches = ["ESCU - Open Redirect in Splunk Web - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table"]
 description = Keeping your Splunk deployment up to date is critical and may help you reduce the risk of CVE-2016-4859, an open-redirection vulnerability within some older versions of Splunk Enterprise. The detection search will help ensure that users are being properly authenticated and not being redirected to malicious domains.
 narrative = This Analytic Story is associated with CVE-2016-4859, an open-redirect vulnerability in the following versions of Splunk Enterprise:\
 \
@@ -706,7 +706,7 @@ version = 1.0
 reference = ["https://nvd.nist.gov/vuln/detail/CVE-2018-11409", "https://www.splunk.com/view/SP-CAAAP5E#VulnerabilityDescriptionsandRatings", "https://www.exploit-db.com/exploits/44865/"]
 maintainers = [{"company": "Splunk", "email": "davidd@splunk.com", "name": "David Dorsey"}]
 spec_version = 1
-searches = ["ESCU - Splunk Enterprise Information Disclosure - Rule", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Investigate Web Activity From src_ip", "ESCU - Investigate Network Traffic From src_ip"]
+searches = ["ESCU - Splunk Enterprise Information Disclosure - Rule", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Investigate Network Traffic From src_ip", "ESCU - Investigate Web Activity From src_ip"]
 description = Reduce the risk of CVE-2018-11409, an information disclosure vulnerability within some older versions of Splunk Enterprise, with searches designed to help ensure that your Splunk system does not leak information to authenticated users.
 narrative = Although there have been no reports of it being exploited, Splunk Enterprise versions through 7.0.1 reportedly have a vulnerability that may expose information through a REST endpoint (read more here: https://www.splunk.com/view/SP-CAAAP5E#VulnerabilityDescriptionsandRatings). NIST has included it in its vulnerability database (read more here: https://nvd.nist.gov/vuln/detail/CVE-2018-11409). The REST endpoint that exposes system information is also necessary for the proper operation of Splunk clustering and instrumentation. Customers should upgrade to the latest version to reduce the risk of this vulnerability.\
 \
@@ -723,7 +723,7 @@ version = 1.0
 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
 maintainers = [{"company": "Splunk", "email": "bpatel@splunk.com", "name": "Bhavin Patel"}]
 spec_version = 1
-searches = ["ESCU - EC2 Instance Started In Previously Unseen Region - Rule", "ESCU - Abnormally High AWS Instances Terminated by User - Rule", "ESCU - Abnormally High AWS Instances Launched by User - Rule", "ESCU - EC2 Instance Started With Previously Unseen User - Rule", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get EC2 Instance Details by instanceId", "ESCU - Investigate AWS activities via region name", "ESCU - AWS Investigate User Activities By ARN", "ESCU - Previously Seen AWS Regions", "ESCU - Previously Seen EC2 Launches By User", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get EC2 Instance Details by instanceId", "ESCU - Investigate AWS activities via region name", "ESCU - AWS Investigate User Activities By ARN", "ESCU - Previously Seen AWS Regions", "ESCU - Previously Seen EC2 Launches By User", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get EC2 Instance Details by instanceId", "ESCU - Investigate AWS activities via region name", "ESCU - AWS Investigate User Activities By ARN", "ESCU - Previously Seen AWS Regions", "ESCU - Previously Seen EC2 Launches By User", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get EC2 Instance Details by instanceId", "ESCU - Investigate AWS activities via region name", "ESCU - AWS Investigate User Activities By ARN", "ESCU - Previously Seen AWS Regions", "ESCU - Previously Seen EC2 Launches By User"]
+searches = ["ESCU - EC2 Instance Started In Previously Unseen Region - Rule", "ESCU - Abnormally High AWS Instances Terminated by User - Rule", "ESCU - Abnormally High AWS Instances Launched by User - Rule", "ESCU - EC2 Instance Started With Previously Unseen User - Rule", "ESCU - AWS Investigate User Activities By ARN", "ESCU - Get EC2 Instance Details by instanceId", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table", "ESCU - Investigate AWS activities via region name", "ESCU - Previously Seen AWS Regions", "ESCU - Previously Seen EC2 Launches By User"]
 description = Use the searches in this Analytic Story to monitor your AWS EC2 instances for evidence of anomalous activity and suspicious behaviors, such as EC2 instances that originate from unusual locations or those launched by previously unseen users (among others). Included investigative searches will help you probe more deeply, when the information warrants it.
 narrative = AWS CloudTrail is an AWS service that helps you enable governance, compliance, and risk auditing within your AWS account. Actions taken by a user, role, or an AWS service are recorded as events in CloudTrail. It is crucial for a company to monitor events and actions taken in the AWS Console, AWS command-line interface, and AWS SDKs and APIs to ensure that your EC2 instances are not vulnerable to attacks. This Analytic Story identifies suspicious activities in your AWS EC2 instances and helps you respond and investigate those activities.
 
@@ -734,7 +734,7 @@ version = 1.0
 reference = ["https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html   "]
 maintainers = [{"company": "Splunk", "email": "bpatel@splunk.com", "name": "Bhavin Patel"}]
 spec_version = 1
-searches = ["ESCU - Detect new user AWS Console Login - Rule", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - AWS Investigate User Activities By ARN", "ESCU - Previously seen users in CloudTrail"]
+searches = ["ESCU - Detect new user AWS Console Login - Rule", "ESCU - AWS Investigate User Activities By ARN", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table", "ESCU - Previously seen users in CloudTrail"]
 description = Monitor your AWS authentication events using your CloudTrail logs. Searches within this Analytic Story will help you stay aware of and investigate suspicious logins.
 narrative = It is important to monitor and control who has access to your AWS infrastructure. Detecting suspicious logins to your AWS infrastructure will provide good starting points for investigations. Abusive behaviors caused by compromised credentials can lead to direct monetary costs, as you will be billed for any EC2 instances created by the attacker.
 
@@ -745,7 +745,7 @@ version = 2.0
 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://www.tripwire.com/state-of-security/security-data-protection/cloud/public-aws-s3-buckets-writable/"]
 maintainers = [{"company": "Splunk", "email": "bpatel@splunk.com", "name": "Bhavin Patel"}]
 spec_version = 1
-searches = ["ESCU - Detect New Open S3 buckets - Rule", "ESCU - Detect S3 access from a new IP - Rule", "ESCU - Detect Spike in S3 Bucket deletion - Rule", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - AWS S3 Bucket details via bucketName", "ESCU - Investigate AWS activities via region name", "ESCU - AWS Investigate User Activities By ARN", "ESCU - Get All AWS Activity From IP Address", "ESCU - Previously seen S3 bucket access by remote IP", "ESCU - Baseline of S3 Bucket deletion activity by ARN", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - AWS S3 Bucket details via bucketName", "ESCU - Investigate AWS activities via region name", "ESCU - AWS Investigate User Activities By ARN", "ESCU - Get All AWS Activity From IP Address", "ESCU - Previously seen S3 bucket access by remote IP", "ESCU - Baseline of S3 Bucket deletion activity by ARN", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - AWS S3 Bucket details via bucketName", "ESCU - Investigate AWS activities via region name", "ESCU - AWS Investigate User Activities By ARN", "ESCU - Get All AWS Activity From IP Address", "ESCU - Previously seen S3 bucket access by remote IP", "ESCU - Baseline of S3 Bucket deletion activity by ARN"]
+searches = ["ESCU - Detect New Open S3 buckets - Rule", "ESCU - Detect S3 access from a new IP - Rule", "ESCU - Detect Spike in S3 Bucket deletion - Rule", "ESCU - AWS Investigate User Activities By ARN", "ESCU - AWS S3 Bucket details via bucketName", "ESCU - Get All AWS Activity From IP Address", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table", "ESCU - Investigate AWS activities via region name", "ESCU - Baseline of S3 Bucket deletion activity by ARN", "ESCU - Previously seen S3 bucket access by remote IP"]
 description = Use the searches in this Analytic Story to monitor your AWS S3 buckets for evidence of anomalous activity and suspicious behaviors, such as detecting open S3 buckets and buckets being accessed from a new IP. The contextual and investigative searches will give you more information, when required.
 narrative = As cloud computing has exploded, so has the number of creative attacks on virtual environments. And as the number-two cloud-service provider, Amazon Web Services (AWS) has certainly had its share.\
 \
@@ -760,7 +760,7 @@ version = 1.0
 reference = ["https://rhinosecuritylabs.com/aws/hiding-cloudcobalt-strike-beacon-c2-using-amazon-apis/"]
 maintainers = [{"company": "Splunk", "email": "bpatel@splunk.com", "name": "Bhavin Patel"}]
 spec_version = 1
-searches = ["ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - AWS Network Interface details via resourceId", "ESCU - Get All AWS Activity From IP Address", "ESCU - Baseline of blocked outbound traffic from AWS"]
+searches = ["ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - AWS Network Interface details via resourceId", "ESCU - Get All AWS Activity From IP Address", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Baseline of blocked outbound traffic from AWS"]
 description = Leverage these searches to monitor your AWS network traffic for evidence of anomalous activity and suspicious behaviors, such as a spike in blocked outbound traffic in your virtual private cloud (VPC).
 narrative = A virtual private cloud (VPC) is an on-demand managed cloud-computing service that isolates computing resources for each client. Inside the VPC container, the environment resembles a physical network. \
 \
@@ -777,7 +777,7 @@ version = 2.0
 reference = ["https://attack.mitre.org/wiki/Technique/T1059", "https://www.microsoft.com/en-us/wdsi/threats/macro-malware", "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"]
 maintainers = [{"company": "Splunk", "email": "bpatel@splunk.com", "name": "Bhavin Patel"}]
 spec_version = 1
-searches = ["ESCU - First time seen command line argument - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Detect Prohibited Applications Spawning cmd.exe - Rule", "ESCU - Detect Use of cmd.exe to Launch Script Interpreters - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Investigate Web Activity From Host", "ESCU - Previously seen command line arguments", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Investigate Web Activity From Host", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Registry Activities", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Investigate Web Activity From Host", "ESCU - Previously seen command line arguments", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Investigate Web Activity From Host"]
+searches = ["ESCU - First time seen command line argument - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Detect Prohibited Applications Spawning cmd.exe - Rule", "ESCU - Detect Use of cmd.exe to Launch Script Interpreters - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get User Information from Identity Table", "ESCU - Investigate Web Activity From Host", "ESCU - Previously seen command line arguments"]
 description = Leveraging the Windows command-line interface (CLI) is one of the most common attack techniques--one that is also detailed in the MITRE ATT&CK framework. Use this Analytic Story to help you identify unusual or suspicious use of the CLI on Windows systems.
 narrative = The ability to execute arbitrary commands via the Windows CLI is a primary goal for the adversary. With access to the shell, an attacker can easily run scripts and interact with the target system. Often, attackers may only have limited access to the shell or may obtain access in unusual ways. In addition, malware may execute and interact with the CLI in ways that would be considered unusual and inconsistent with typical user activity. This provides defenders with opportunities to identify suspicious use and investigate, as appropriate. This Analytic Story contains various searches to help identify this suspicious activity, as well as others to aid you in deeper investigation.
 
@@ -788,7 +788,7 @@ version = 1.0
 reference = ["http://blogs.splunk.com/2015/10/01/random-words-on-entropy-and-dns/", "http://www.darkreading.com/analytics/security-monitoring/got-malware-three-signs-revealed-in-dns-traffic/d/d-id/1139680", "https://live.paloaltonetworks.com/t5/Threat-Vulnerability-Articles/What-are-suspicious-DNS-queries/ta-p/71454"]
 maintainers = [{"company": "Splunk", "email": "rvaldez@splunk.com", "name": "Rico Valdez"}]
 spec_version = 1
-searches = ["ESCU - Excessive DNS Failures - Rule", "ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get DNS Server History for a host", "ESCU - Get DNS traffic ratio", "ESCU - Get Process responsible for the DNS traffic", "ESCU - Get DNS Server History for a host", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get DNS Server History for a host", "ESCU - Get DNS traffic ratio", "ESCU - Get Process responsible for the DNS traffic", "ESCU - Get DNS Server History for a host", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get DNS Server History for a host", "ESCU - Get DNS traffic ratio", "ESCU - Get Process responsible for the DNS traffic", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get DNS Server History for a host", "ESCU - Get DNS traffic ratio", "ESCU - Get Process responsible for the DNS traffic", "ESCU - Get DNS Server History for a host"]
+searches = ["ESCU - Excessive DNS Failures - Rule", "ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get DNS Server History for a host", "ESCU - Get DNS traffic ratio", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Process responsible for the DNS traffic", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table"]
 description = Attackers often attempt to hide within or otherwise abuse the domain name system (DNS). You can thwart attempts to manipulate this omnipresent protocol by monitoring for these types of abuses.
 narrative = Although DNS is one of the fundamental underlying protocols that make the Internet work, it is often ignored (perhaps because of its complexity and effectiveness).  However, attackers have discovered ways to abuse the protocol to meet their objectives. One potential abuse involves manipulating DNS to hijack traffic and redirect it to an IP address under the attacker's control. This could inadvertently send users intending to visit google.com, for example, to an unrelated malicious website. Another technique involves using the DNS protocol for command-and-control activities with the attacker's malicious code or to covertly exfiltrate data. The searches within this Analytic Story look for these types of abuses.
 
@@ -799,7 +799,7 @@ version = 1.0
 reference = ["https://www.splunk.com/blog/2015/06/26/phishing-hits-a-new-level-of-quality/"]
 maintainers = [{"company": "Splunk", "email": "bpatel@splunk.com", "name": "Bhavin Patel"}]
 spec_version = 1
-searches = ["ESCU - Suspicious Email Attachment Extensions - Rule", "ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Email Info", "ESCU - Get Emails From Specific Sender", "ESCU - Investigate Web Activity From Host", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Email Info", "ESCU - Get Emails From Specific Sender", "ESCU - Investigate Web Activity From Host"]
+searches = ["ESCU - Suspicious Email Attachment Extensions - Rule", "ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Email Info", "ESCU - Get Emails From Specific Sender", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Investigate Web Activity From Host"]
 description = Email remains one of the primary means for attackers to gain an initial foothold within the modern enterprise. Detect and investigate suspicious emails in your environment with the help of the searches in this Analytic Story.
 narrative = It is a common practice for attackers of all types to leverage targeted spearphishing campaigns and mass mailers to deliver weaponized email messages and attachments. Fortunately, there are a number of ways to monitor email data in Splunk to detect suspicious content.\
 \
@@ -818,7 +818,7 @@ version = 1.0
 reference = ["https://redcanary.com/blog/windows-registry-attacks-threat-detection/", "https://medium.com/@mbromileyDFIR/malware-monday-aebb456356c5", "https://attack.mitre.org/wiki/Technique/T1170"]
 maintainers = [{"company": "Splunk", "email": "bpatel@splunk.com", "name": "Bhavin Patel"}]
 spec_version = 1
-searches = ["ESCU - Detect mshta.exe running scripts in command-line arguments - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Detect Prohibited Applications Spawning cmd.exe - Rule", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Registry Activities", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Registry Activities", "ESCU - Get Parent Process Info"]
+searches = ["ESCU - Detect mshta.exe running scripts in command-line arguments - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Detect Prohibited Applications Spawning cmd.exe - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Registry Activities", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table"]
 description = Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code.
 narrative = One common adversary tactic is to bypass application white-listing solutions via the mshta.exe process, which executes Microsoft HTML applications with the .hta suffix. In these cases, attackers use the trusted Windows utility to eproxy execution of malicious files, whether an .hta application, javascript, or VBScript.\
 \
@@ -833,7 +833,7 @@ version = 2.0
 reference = ["https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf", "https://www.fireeye.com/blog/threat-research/2017/03/wmimplant_a_wmi_ba.html"]
 maintainers = [{"company": "Splunk", "email": "rvaldez@splunk.com", "name": "Rico Valdez"}]
 spec_version = 1
-searches = ["ESCU - Remote WMI Command Attempt - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - WMI Permanent Event Subscription - Rule", "ESCU - WMI Permanent Event Subscription - Sysmon - Rule", "ESCU - WMI Temporary Event Subscription - Rule", "ESCU - Process Execution via WMI - Rule", "ESCU - Script Execution via WMI - Rule", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Sysmon WMI Activity for Host", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Sysmon WMI Activity for Host", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Sysmon WMI Activity for Host", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Sysmon WMI Activity for Host", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Sysmon WMI Activity for Host", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Sysmon WMI Activity for Host", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Sysmon WMI Activity for Host"]
+searches = ["ESCU - Remote WMI Command Attempt - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - WMI Permanent Event Subscription - Rule", "ESCU - WMI Permanent Event Subscription - Sysmon - Rule", "ESCU - WMI Temporary Event Subscription - Rule", "ESCU - Process Execution via WMI - Rule", "ESCU - Script Execution via WMI - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Sysmon WMI Activity for Host", "ESCU - Get User Information from Identity Table"]
 description = Attackers are increasingly abusing Windows Management Instrumentation (WMI), a framework and associated utilities available on all modern Windows operating systems. Because WMI can be leveraged to manage both local and remote systems, it is important to identify the processes executed and the user context within which the activity occurred.
 narrative = WMI is a Microsoft infrastructure for management data and operations on Windows operating systems. It includes of a set of utilities that can be leveraged to manage both local and remote Windows systems. Attackers are increasingly turning to WMI abuse in their efforts to conduct nefarious tasks, such as reconnaissance, detection of antivirus and virtual machines, code execution, lateral movement, persistence, and data exfiltration. \
 \
@@ -848,7 +848,7 @@ version = 1.0
 reference = ["https://redcanary.com/blog/windows-registry-attacks-threat-detection/", "https://attack.mitre.org/wiki/Technique/T1112"]
 maintainers = [{"company": "Splunk", "email": "bpatel@splunk.com", "name": "Bhavin Patel"}]
 spec_version = 1
-searches = ["ESCU - Remote Registry Key modifications - Rule", "ESCU - Suspicious Changes to File Associations - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Reg.exe used to hide files/directories via registry keys - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info"]
+searches = ["ESCU - Remote Registry Key modifications - Rule", "ESCU - Suspicious Changes to File Associations - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Reg.exe used to hide files/directories via registry keys - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Registry Activities", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table"]
 description = Monitor and detect registry changes initiated from remote locations, which can be a sign that an attacker has infiltrated your system.
 narrative = Attackers are developing increasingly sophisticated techniques for hijacking target servers, while evading detection. One such technique that has become progressively more common is registry modification.\
 \
@@ -863,7 +863,7 @@ version = 1.0
 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
 maintainers = [{"company": "Splunk", "email": "davidd@splunk.com", "name": "David Dorsey"}]
 spec_version = 1
-searches = ["ESCU - EC2 Instance Modified With Previously Unseen User - Rule", "ESCU - Get Notable History", "ESCU - Get EC2 Instance Details by instanceId", "ESCU - AWS Investigate User Activities By ARN", "ESCU - Previously Seen EC2 Modifications By User"]
+searches = ["ESCU - EC2 Instance Modified With Previously Unseen User - Rule", "ESCU - AWS Investigate User Activities By ARN", "ESCU - Get EC2 Instance Details by instanceId", "ESCU - Get Notable History", "ESCU - Previously Seen EC2 Modifications By User"]
 description = Identify unusual changes to your AWS EC2 instances that may indicate malicious activity. Modifications to your EC2 instances by previously unseen users is an example of an activity that may warrant further investigation.
 narrative = A common attack technique is to infiltrate a cloud instance and make modifications. The adversary can then secure access to your infrastructure or hide their activities. So it's important to stay alert to changes that may indicate that your environment has been compromised. \
 \
@@ -876,7 +876,7 @@ version = 2.0
 reference = ["https://www.fireeye.com/blog/threat-research/2017/08/monitoring-windows-console-activity-part-two.html", "https://www.splunk.com/pdfs/technical-briefs/advanced-threat-detection-and-response-tech-brief.pdf", "https://www.sans.org/reading-room/whitepapers/logging/detecting-security-incidents-windows-workstation-event-logs-34262"]
 maintainers = [{"company": "Splunk", "email": "bpatel@splunk.com", "name": "Bhavin Patel"}]
 spec_version = 1
-searches = ["ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Detect Rare Executables - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - Detect processes used for System Network Configuration Discovery - Rule", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Investigate Web Activity From Host", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Investigate Web Activity From Host", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Investigate Web Activity From Host", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Investigate Web Activity From Host", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Investigate Web Activity From Host"]
+searches = ["ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Detect Rare Executables - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - Detect processes used for System Network Configuration Discovery - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Investigate Web Activity From Host"]
 description = Quickly identify systems running new or unusual processes in your environment that could be indicators of suspicious activity. Processes run from unusual locations, those with conspicuously long command lines, and rare executables are all examples of activities that may warrant deeper investigation.
 narrative = Being able to profile a host's processes within your environment can help you more quickly identify processes that seem out of place when compared to the rest of the population of hosts or asset types.\
 \
@@ -891,7 +891,7 @@ version = 1.0
 reference = ["https://www.monkey.org/~dugsong/dsniff/"]
 maintainers = [{"company": "Splunk", "email": "bpatel@splunk.com", "name": "Bhavin Patel"}]
 spec_version = 1
-searches = ["ESCU - Protocols passing authentication in cleartext - Rule", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Information For Port Activity"]
+searches = ["ESCU - Protocols passing authentication in cleartext - Rule", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Process Information For Port Activity", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table"]
 description = Leverage searches that detect cleartext network protocols that may leak credentials or should otherwise be encrypted.
 narrative = Various legacy protocols operate by default in the clear, without the protections of encryption. This potentially leaks sensitive information that can be exploited by passively sniffing network traffic. Depending on the protocol, this information could be highly sensitive, or could allow for session hijacking. In addition, these protocols send authentication information, which would allow for the harvesting of usernames and passwords that could potentially be used to authenticate and compromise secondary systems.
 
@@ -902,7 +902,7 @@ version = 1.0
 reference = ["https://www.fbi.gov/scams-and-safety/common-fraud-schemes/internet-fraud", "https://www.fbi.gov/news/stories/2017-internet-crime-report-released-050718", "https://www.otalliance.org/news-events/press-releases/online-trust-alliance-reports-doubling-cyber-incidents-2017-0"]
 maintainers = [{"company": "Splunk", "email": "Mayhem@splunk.com", "name": "Jim Apger"}]
 spec_version = 1
-searches = ["ESCU - Web Fraud - Account Harvesting - Rule", "ESCU - Web Fraud - Anomalous User Clickspeed - Rule", "ESCU - Web Fraud - Password Sharing Across Accounts - Rule", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get Emails From Specific Sender", "ESCU - Get Web Session Information via session_id", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get Emails From Specific Sender", "ESCU - Get Web Session Information via session_id", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get Emails From Specific Sender", "ESCU - Get Web Session Information via session_id"]
+searches = ["ESCU - Web Fraud - Account Harvesting - Rule", "ESCU - Web Fraud - Anomalous User Clickspeed - Rule", "ESCU - Web Fraud - Password Sharing Across Accounts - Rule", "ESCU - Get Emails From Specific Sender", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Web Session Information via session_id"]
 description = Monitor your environment for activity consistent with common attack techniques bad actors use when attempting to compromise web servers or other web-related assets.
 narrative = The Federal Bureau of Investigations (FBI) defines Internet fraud as the use of Internet services or software with Internet access to defraud victims or to otherwise take advantage of them. According to the Bureau, Internet crime schemes are used to steal millions of dollars each year from victims and continue to plague the Internet through various methods. The agency includes phishing scams, data breaches, Denial of Service (DOS) attacks, email account compromise, malware, spoofing, and ransomware in this category.\
 \
@@ -923,7 +923,7 @@ version = 1.0
 reference = ["https://attack.mitre.org/wiki/Defense_Evasion"]
 maintainers = [{"company": "Splunk", "email": "davidd@splunk.com", "name": "David Dorsey"}]
 spec_version = 1
-searches = ["ESCU - Suspicious Reg.exe Process - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Hiding Files And Directories With Attrib.exe - Rule", "ESCU - Reg.exe used to hide files/directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info"]
+searches = ["ESCU - Suspicious Reg.exe Process - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Hiding Files And Directories With Attrib.exe - Rule", "ESCU - Reg.exe used to hide files/directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get User Information from Identity Table"]
 description = Detect tactics used by malware to evade defenses on Windows endpoints. A few of these include suspicious `reg.exe` processes, files hidden with `attrib.exe` and disabling user-account control, among many others
 narrative = Defense evasion is a tactic--identified in the MITRE ATT&CK framework--that adversaries employ in a variety of ways to bypass or defeat defensive security measures. There are many techniques enumerated by the MITRE ATT&CK framework that are applicable in this context. This Analytic Story includes searches designed to identify the use of such techniques on Windows platforms.
 
@@ -934,7 +934,7 @@ version = 1.0
 reference = ["https://blog.malwarebytes.com/cybercrime/2013/12/file-extensions-2/", "https://attack.mitre.org/wiki/Technique/T1042"]
 maintainers = [{"company": "Splunk", "email": "rvaldez@splunk.com", "name": "Rico Valdez"}]
 spec_version = 1
-searches = ["ESCU - Execution of File with Multiple Extensions - Rule", "ESCU - Execution of File With Spaces Before Extension - Rule", "ESCU - Suspicious Changes to File Associations - Rule", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info"]
+searches = ["ESCU - Execution of File with Multiple Extensions - Rule", "ESCU - Execution of File With Spaces Before Extension - Rule", "ESCU - Suspicious Changes to File Associations - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table"]
 description = Detect and investigate suspected abuse of file extensions and Windows file associations. Some of the malicious behaviors involved may include inserting spaces before file extensions or prepending the file extension with a different one, among other techniques.
 narrative = Attackers use a variety of techniques to entice users to run malicious code or to persist on an endpoint. One way to accomplish these goals is to leverage file extensions and the mechanism Windows uses to associate files with specific applications. \
 \
@@ -953,7 +953,7 @@ version = 2.0
 reference = ["https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/", "https://zeltser.com/security-incident-log-review-checklist/", "http://journeyintoir.blogspot.com/2013/01/re-introducing-usnjrnl.html"]
 maintainers = [{"company": "Splunk", "email": "rvaldez@splunk.com", "name": "Rico Valdez"}]
 spec_version = 1
-searches = ["ESCU - Deleting Shadow Copies - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info"]
+searches = ["ESCU - Deleting Shadow Copies - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table"]
 description = Adversaries often try to cover their tracks by manipulating Windows logs. Use these searches to help you monitor for suspicious activity surrounding log files--an essential component of an effective defense.
 narrative = Because attackers often modify system logs to cover their tracks and/or to thwart the investigative process, log monitoring is an industry-recognized best practice. While there are legitimate reasons to manipulate system logs, it is still worthwhile to keep track of who manipulated the logs, when they manipulated them, and in what way they manipulated them (determining which accesses, tools, or utilities were employed). Even if no malicious activity is detected, the knowledge of an attempt to manipulate system logs may be indicative of a broader security risk that should be thoroughly investigated.\
 \
@@ -966,7 +966,7 @@ version = 2.0
 reference = ["http://www.fuzzysecurity.com/tutorials/19.html", "https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html", "http://resources.infosecinstitute.com/common-malware-persistence-mechanisms/", "https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html", "https://www.defcon.org/images/defcon-22/dc-22-presentations/Bloxham/DEFCON-22-Brady-Bloxham-Windows-API-Abuse-UPDATED.pdf"]
 maintainers = [{"company": "Splunk", "email": "davidd@splunk.com", "name": "David Dorsey"}, {"company": "Splunk", "email": "bpatel@splunk.com", "name": "Bhavin Patel"}]
 spec_version = 1
-searches = ["ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Shim Database Installation With Suspicious Parameters - Rule", "ESCU - Shim Database File Creation - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Sc.exe Manipulating Windows Services - Rule", "ESCU - Reg.exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Hiding Files And Directories With Attrib.exe - Rule", "ESCU - Reg.exe used to hide files/directories via registry keys - Rule", "ESCU - Detect Path Interception By Creation Of program.exe - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Previously Seen Running Windows Services", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Previously Seen Running Windows Services", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info"]
+searches = ["ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Shim Database Installation With Suspicious Parameters - Rule", "ESCU - Shim Database File Creation - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Sc.exe Manipulating Windows Services - Rule", "ESCU - Reg.exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Hiding Files And Directories With Attrib.exe - Rule", "ESCU - Reg.exe used to hide files/directories via registry keys - Rule", "ESCU - Detect Path Interception By Creation Of program.exe - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table"]
 description = Monitor for activities and techniques associated with maintaining persistence on a Windows system--a sign that an adversary may have compromised your environment.
 narrative = Maintaining persistence is one of the first steps taken by attackers after the initial compromise. Attackers leverage various custom and built-in tools to ensure survivability and persistent access within a compromised enterprise. This Analytic Story provides searches to help you identify various behaviors used by attackers to maintain persistent access to a Windows environment.
 
@@ -977,7 +977,7 @@ version = 2.0
 reference = ["https://attack.mitre.org/wiki/Privilege_Escalation"]
 maintainers = [{"company": "Splunk", "email": "davidd@splunk.com", "name": "David Dorsey"}]
 spec_version = 1
-searches = ["ESCU - Overwriting Accessibility Binaries - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Child Processes of Spoolsv.exe - Rule", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info"]
+searches = ["ESCU - Overwriting Accessibility Binaries - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Child Processes of Spoolsv.exe - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table"]
 description = Monitor for and investigate activities that may be associated with a Windows privilege-escalation attack, including unusual processes running on endpoints, modified registry keys, and more.
 narrative = Privilege escalation is a "land-and-expand" technique, wherein an adversary gains an initial foothold on a host and then exploits its weaknesses to increase his privileges. The motivation is simple: certain actions on a Windows machine--such as installing software--may require higher-level privileges than those the attacker initially acquired. By increasing his privilege level, the attacker can gain the control required to carry out his malicious ends. This Analytic Story provides searches to detect and investigate behaviors that attackers may use to elevate their privileges in your environment.
 
@@ -988,7 +988,7 @@ version = 3.0
 reference = ["https://attack.mitre.org/wiki/Technique/T1050", "https://attack.mitre.org/wiki/Technique/T1031"]
 maintainers = [{"company": "Splunk", "email": "rvaldez@splunk.com", "name": "Rico Valdez"}]
 spec_version = 1
-searches = ["ESCU - Sc.exe Manipulating Windows Services - Rule", "ESCU - Reg.exe Manipulating Windows Services Registry Keys - Rule", "ESCU - First Time Seen Running Windows Service - Rule", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Previously Seen Running Windows Services", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Previously Seen Running Windows Services", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Process Info", "ESCU - Get Parent Process Info", "ESCU - Previously Seen Running Windows Services"]
+searches = ["ESCU - Sc.exe Manipulating Windows Services - Rule", "ESCU - Reg.exe Manipulating Windows Services Registry Keys - Rule", "ESCU - First Time Seen Running Windows Service - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Previously Seen Running Windows Services"]
 description = Windows services are often used by attackers for persistence and the ability to load drivers or otherwise interact with the Windows kernel. This Analytic Story helps you monitor your environment for indications that Windows services are being modified or created in a suspicious manner.
 narrative = The Windows operating system uses a services architecture to allow for running code in the background, similar to a UNIX daemon. Attackers will often leverage Windows services for persistence, hiding in plain sight, seeking the ability to run privileged code that can interact with the kernel. In many cases, attackers will create a new service to host their malicious code. Attackers have also been observed modifying unnecessary or unused services to point to their own code, as opposed to what was intended. In these cases, attackers often use tools to create or modify services in ways that are not typical for most environments, providing opportunities for detection.