Branch was auto-updated.

bin/contentctl_project/contentctl_core/application/factory/ba_factory.py

@@ -1,5 +1,7 @@
 import os
+import sys
 
+from pydantic import ValidationError
 from dataclasses import dataclass
 
 from bin.contentctl_project.contentctl_core.domain.entities.enums.enums import SecurityContentType
@@ -44,15 +46,25 @@ class BAFactory():
         else:
             files = Utils.get_all_yml_files_from_directory(os.path.join(self.input_dto.input_path, str(type.name)))
 
+        validation_error_found = False
+
         for file in files:
             if 'ssa__' in file:
-                if type == SecurityContentType.detections:
-                    self.input_dto.director.constructDetection(self.input_dto.detection_builder, file, [], [], [], self.output_dto.tests, {}, [], [])
-                    detection = self.input_dto.detection_builder.getObject()
-                    if not detection.deprecated and not detection.experimental:
-                        self.output_dto.detections.append(detection)
-                elif type == SecurityContentType.unit_tests:
-                    self.input_dto.director.constructTest(self.input_dto.basic_builder, file)
-                    test = self.input_dto.basic_builder.getObject()
-                    self.output_dto.tests.append(test)
-                    
+                try:
+                    if type == SecurityContentType.detections:
+                        self.input_dto.director.constructDetection(self.input_dto.detection_builder, file, [], [], [], self.output_dto.tests, {}, [], [])
+                        detection = self.input_dto.detection_builder.getObject()
+                        if not detection.deprecated and not detection.experimental:
+                            self.output_dto.detections.append(detection)
+                    elif type == SecurityContentType.unit_tests:
+                        self.input_dto.director.constructTest(self.input_dto.basic_builder, file)
+                        test = self.input_dto.basic_builder.getObject()
+                        self.output_dto.tests.append(test)
+                    
+                except ValidationError as e:
+                    print('\nValidation Error for file ' + file)
+                    print(e)
+                    validation_error_found = True
+
+        if validation_error_found:
+            sys.exit(1)

bin/contentctl_project/contentctl_core/application/factory/factory.py

@@ -1,5 +1,7 @@
 import os
+import sys
 
+from pydantic import ValidationError
 from dataclasses import dataclass
 
 from bin.contentctl_project.contentctl_core.domain.entities.enums.enums import SecurityContentProduct
@@ -59,9 +61,7 @@ class Factory():
           self.createSecurityContent(SecurityContentType.deployments)
           self.createSecurityContent(SecurityContentType.baselines)
           self.createSecurityContent(SecurityContentType.investigations)
-          self.createSecurityContent(SecurityContentType.detections) # execution only for playbook enrichment
           self.createSecurityContent(SecurityContentType.playbooks)
-          self.output_dto.detections = []
           self.createSecurityContent(SecurityContentType.detections)
           self.createSecurityContent(SecurityContentType.stories)
 
@@ -75,50 +75,60 @@ class Factory():
           else:
                files = Utils.get_all_yml_files_from_directory(os.path.join(self.input_dto.input_path, str(type.name)))
           
+          validation_error_found = False
+
           for file in files:
                if not 'ssa__' in file:
-                    if type == SecurityContentType.lookups:
-                         self.input_dto.director.constructLookup(self.input_dto.basic_builder, file)
-                         self.output_dto.lookups.append(self.input_dto.basic_builder.getObject())
-                    
-                    elif type == SecurityContentType.macros:
-                         self.input_dto.director.constructMacro(self.input_dto.basic_builder, file)
-                         self.output_dto.macros.append(self.input_dto.basic_builder.getObject())
-                    
-                    elif type == SecurityContentType.deployments:
-                         self.input_dto.director.constructDeployment(self.input_dto.basic_builder, file)
-                         self.output_dto.deployments.append(self.input_dto.basic_builder.getObject())
-                    
-                    elif type == SecurityContentType.playbooks:
-                         self.input_dto.director.constructPlaybook(self.input_dto.playbook_builder, file, self.output_dto.detections)
-                         self.output_dto.playbooks.append(self.input_dto.playbook_builder.getObject())                    
-                    
-                    elif type == SecurityContentType.baselines:
-                         self.input_dto.director.constructBaseline(self.input_dto.baseline_builder, file, self.output_dto.deployments)
-                         baseline = self.input_dto.baseline_builder.getObject()
-                         self.output_dto.baselines.append(baseline)
-                    
-                    elif type == SecurityContentType.investigations:
-                         self.input_dto.director.constructInvestigation(self.input_dto.investigation_builder, file)
-                         investigation = self.input_dto.investigation_builder.getObject()
-                         self.output_dto.investigations.append(investigation)
+                    try:
+                         if type == SecurityContentType.lookups:
+                              self.input_dto.director.constructLookup(self.input_dto.basic_builder, file)
+                              self.output_dto.lookups.append(self.input_dto.basic_builder.getObject())
+                         
+                         elif type == SecurityContentType.macros:
+                              self.input_dto.director.constructMacro(self.input_dto.basic_builder, file)
+                              self.output_dto.macros.append(self.input_dto.basic_builder.getObject())
+                         
+                         elif type == SecurityContentType.deployments:
+                              self.input_dto.director.constructDeployment(self.input_dto.basic_builder, file)
+                              self.output_dto.deployments.append(self.input_dto.basic_builder.getObject())
+                         
+                         elif type == SecurityContentType.playbooks:
+                              self.input_dto.director.constructPlaybook(self.input_dto.playbook_builder, file)
+                              self.output_dto.playbooks.append(self.input_dto.playbook_builder.getObject())                    
+                         
+                         elif type == SecurityContentType.baselines:
+                              self.input_dto.director.constructBaseline(self.input_dto.baseline_builder, file, self.output_dto.deployments)
+                              baseline = self.input_dto.baseline_builder.getObject()
+                              self.output_dto.baselines.append(baseline)
+                         
+                         elif type == SecurityContentType.investigations:
+                              self.input_dto.director.constructInvestigation(self.input_dto.investigation_builder, file)
+                              investigation = self.input_dto.investigation_builder.getObject()
+                              self.output_dto.investigations.append(investigation)
 
-                    elif type == SecurityContentType.stories:
-                         self.input_dto.director.constructStory(self.input_dto.story_builder, file, 
-                              self.output_dto.detections, self.output_dto.baselines, self.output_dto.investigations)
-                         story = self.input_dto.story_builder.getObject()
-                         self.output_dto.stories.append(story)
-               
-                    elif type == SecurityContentType.detections:
-                         self.input_dto.director.constructDetection(self.input_dto.detection_builder, file, 
-                              self.output_dto.deployments, self.output_dto.playbooks, self.output_dto.baselines,
-                              self.output_dto.tests, self.input_dto.attack_enrichment, self.output_dto.macros,
-                              self.output_dto.lookups)
-                         detection = self.input_dto.detection_builder.getObject()
-                         self.output_dto.detections.append(detection)
-               
-                    elif type == SecurityContentType.unit_tests:
-                         self.input_dto.director.constructTest(self.input_dto.basic_builder, file)
-                         test = self.input_dto.basic_builder.getObject()
-                         self.output_dto.tests.append(test)
-               
+                         elif type == SecurityContentType.stories:
+                              self.input_dto.director.constructStory(self.input_dto.story_builder, file, 
+                                   self.output_dto.detections, self.output_dto.baselines, self.output_dto.investigations)
+                              story = self.input_dto.story_builder.getObject()
+                              self.output_dto.stories.append(story)
+                    
+                         elif type == SecurityContentType.detections:
+                              self.input_dto.director.constructDetection(self.input_dto.detection_builder, file, 
+                                   self.output_dto.deployments, self.output_dto.playbooks, self.output_dto.baselines,
+                                   self.output_dto.tests, self.input_dto.attack_enrichment, self.output_dto.macros,
+                                   self.output_dto.lookups)
+                              detection = self.input_dto.detection_builder.getObject()
+                              self.output_dto.detections.append(detection)
+                    
+                         elif type == SecurityContentType.unit_tests:
+                              self.input_dto.director.constructTest(self.input_dto.basic_builder, file)
+                              test = self.input_dto.basic_builder.getObject()
+                              self.output_dto.tests.append(test)
+                    
+                    except ValidationError as e:
+                         print('\nValidation Error for file ' + file)
+                         print(e)
+                         validation_error_found = True
+
+          if validation_error_found:
+               sys.exit(1)

bin/contentctl_project/contentctl_core/application/use_cases/doc_gen.py

@@ -20,4 +20,6 @@ class DocGen:
         factory = Factory(factory_output_dto)
         factory.execute(input_dto.factory_input_dto)
 
-        input_dto.adapter.writeObjects([factory_output_dto.stories, factory_output_dto.detections, factory_output_dto.playbooks], input_dto.output_path)
+        input_dto.adapter.writeObjects([factory_output_dto.stories, factory_output_dto.detections, factory_output_dto.playbooks], input_dto.output_path)
+
+        print('Documentation generation of security content successful.')

bin/contentctl_project/contentctl_core/application/use_cases/generate.py

@@ -55,4 +55,6 @@ class Generate:
             input_dto.adapter.writeObjects(factory_output_dto.investigations, input_dto.output_path, SecurityContentType.investigations)
             input_dto.adapter.writeObjects(factory_output_dto.lookups, input_dto.output_path, SecurityContentType.lookups)
             input_dto.adapter.writeObjects(factory_output_dto.macros, input_dto.output_path, SecurityContentType.macros)
-            input_dto.adapter.writeObjects(factory_output_dto.deployments, input_dto.output_path, SecurityContentType.deployments)
+            input_dto.adapter.writeObjects(factory_output_dto.deployments, input_dto.output_path, SecurityContentType.deployments)
+
+        print('Generate of security content successful.')

bin/contentctl_project/contentctl_core/application/use_cases/reporting.py

@@ -21,4 +21,6 @@ class Reporting:
         factory.execute(input_dto.factory_input_dto)
 
         input_dto.adapter_svg.writeObjects(factory_output_dto.detections, os.path.join(os.path.dirname(__file__), '../../../../reporting'))
-        input_dto.adapter_attack.writeObjects(factory_output_dto.detections, os.path.join(os.path.dirname(__file__), '../../../../../docs/mitre-map'))
+        input_dto.adapter_attack.writeObjects(factory_output_dto.detections, os.path.join(os.path.dirname(__file__), '../../../../../docs/mitre-map'))
+
+        print('Reporting of security content successful.')

bin/contentctl_project/contentctl_core/application/use_cases/validate.py

@@ -35,6 +35,8 @@ class Validate:
         # validate tests
         self.validate_detection_exist_for_test(factory_output_dto.tests, factory_output_dto.detections)
         
+        print('Validation of security content successful.')
+        
 
     def validate_detection_exist_for_test(self, tests : list, detections: list):
         for test in tests:

bin/contentctl_project/contentctl_core/domain/entities/playbook_tags.py

@@ -9,5 +9,5 @@ class PlaybookTag(BaseModel):
     playbook_fields: list = None
     product: list = None
     playbook_fields: list = None
-    detection_objects: list = None
+    detection_objects: list = None  
     

bin/contentctl_project/contentctl_infrastructure/adapter/templates/doc_playbooks.j2

@@ -32,7 +32,7 @@ tags:
 #### Associated Detections
 {% if object.tags.detection_objects %}
 {% for detection in object.tags.detection_objects -%}
-* [{{ detection.name }}](/{{ detection.soure }}/{{detection.name|lower|replace(" ", "_")}}/)
+* [{{ detection.name }}](/detection/{{ detection.lowercase_name }}/)
 {% endfor %}
 {% endif %}
 

bin/contentctl_project/contentctl_infrastructure/adapter/templates/doc_playbooks_page.j2

@@ -12,7 +12,7 @@ sidebar:
 | --------| ---------- | ----------- |
 {% for playbook in objects -%}
 {% if playbook.tags.detection_objects -%}
-| [{{ playbook.name }}](/playbooks/{{ playbook.name|lower|replace(' ', '_') }}/)|{% for detection in playbook.tags.detection_objects -%}[{{ detection.name }}](/{{ detection.source }}/{{detection.name|lower|replace(" ", "_")}}/){%- endfor -%} | {{ playbook.type }} |
+| [{{ playbook.name }}](/playbooks/{{ playbook.name|lower|replace(' ', '_') }}/)|{% for detection in playbook.tags.detection_objects -%}[{{ detection.name }}]((/detection/{{ detection.lowercase_name }}/) {%- endfor -%} | {{ playbook.type }} |
 {% else -%}
 | [{{ playbook.name }}](/playbooks/{{ playbook.name|lower|replace(' ', '_') }}/)| None | {{ playbook.type }} |
 {% endif -%}

bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py

@@ -20,202 +20,207 @@ class SecurityContentDetectionBuilder(DetectionBuilder):
     def setObject(self, path: str) -> None:
         yml_dict = YmlReader.load_file(path)
         yml_dict["tags"]["name"] = yml_dict["name"]
-        try:
-            self.security_content_obj = Detection.parse_obj(yml_dict)
-        except ValidationError as e:
-            print('Validation Error for file ' + path)
-            print(e)
-            sys.exit(1)
-
+        self.security_content_obj = Detection.parse_obj(yml_dict)
         self.security_content_obj.source = os.path.split(os.path.dirname(self.security_content_obj.file_path))[-1]      
 
 
     def addDeployment(self, deployments: list) -> None:
-        matched_deployments = []
+        if self.security_content_obj:
+            matched_deployments = []
 
-        for d in deployments:
-            d_tags = dict(d.tags)
-            for d_tag in d_tags.keys():
-                for attr in dir(self.security_content_obj):
-                    if not (attr.startswith('__') or attr.startswith('_')):
-                        if attr == d_tag:
-                            if type(self.security_content_obj.__getattribute__(attr)) is str:
-                                attr_values = [self.security_content_obj.__getattribute__(attr)]
-                            else:
-                                attr_values = self.security_content_obj.__getattribute__(attr)
-                            
-                            for attr_value in attr_values:
-                                if attr_value == d_tags[d_tag]:
-                                    matched_deployments.append(d)
+            for d in deployments:
+                d_tags = dict(d.tags)
+                for d_tag in d_tags.keys():
+                    for attr in dir(self.security_content_obj):
+                        if not (attr.startswith('__') or attr.startswith('_')):
+                            if attr == d_tag:
+                                if type(self.security_content_obj.__getattribute__(attr)) is str:
+                                    attr_values = [self.security_content_obj.__getattribute__(attr)]
+                                else:
+                                    attr_values = self.security_content_obj.__getattribute__(attr)
+                                
+                                for attr_value in attr_values:
+                                    if attr_value == d_tags[d_tag]:
+                                        matched_deployments.append(d)
 
-        if len(matched_deployments) == 0:
-             self.security_content_obj.deployment = None
-        else:
-            self.security_content_obj.deployment = matched_deployments[-1]
+            if len(matched_deployments) == 0:
+                self.security_content_obj.deployment = None
+            else:
+                self.security_content_obj.deployment = matched_deployments[-1]
 
 
     def addRBA(self) -> None:
+        if self.security_content_obj:
+            risk_objects = []
+            risk_object_user_types = {'user', 'username', 'email address'}
+            risk_object_system_types = {'device', 'endpoint', 'hostname', 'ip address'}
 
-        risk_objects = []
-        risk_object_user_types = {'user', 'username', 'email address'}
-        risk_object_system_types = {'device', 'endpoint', 'hostname', 'ip address'}
+            if hasattr(self.security_content_obj.tags, 'observable') and hasattr(self.security_content_obj.tags, 'risk_score'):
+                for entity in self.security_content_obj.tags.observable:
+                    risk_object = dict()
+                    if entity['type'].lower() in risk_object_user_types:
+                        for r in entity['role']:
+                            if 'attacker' == r.lower() or 'victim' ==r.lower():
+                                risk_object['risk_object_type'] = 'user'
+                                risk_object['risk_object_field'] = entity['name']
+                                risk_object['risk_score'] = self.security_content_obj.tags.risk_score
+                                risk_objects.append(risk_object)
 
-        if hasattr(self.security_content_obj.tags, 'observable') and hasattr(self.security_content_obj.tags, 'risk_score'):
-            for entity in self.security_content_obj.tags.observable:
-                risk_object = dict()
-                if entity['type'].lower() in risk_object_user_types:
-                    for r in entity['role']:
-                        if 'attacker' == r.lower() or 'victim' ==r.lower():
-                            risk_object['risk_object_type'] = 'user'
-                            risk_object['risk_object_field'] = entity['name']
-                            risk_object['risk_score'] = self.security_content_obj.tags.risk_score
-                            risk_objects.append(risk_object)
+                    elif entity['type'].lower() in risk_object_system_types:
+                        for r in entity['role']:
+                            if 'attacker' == r.lower() or 'victim' ==r.lower():
+                                risk_object['risk_object_type'] = 'system'
+                                risk_object['risk_object_field'] = entity['name']
+                                risk_object['risk_score'] = self.security_content_obj.tags.risk_score
+                                risk_objects.append(risk_object)
+                    else:
+                        risk_object['threat_object_field'] = entity['name']
+                        risk_object['threat_object_type'] = entity['type'].lower()
+                        risk_objects.append(risk_object)
+                        continue
 
-                elif entity['type'].lower() in risk_object_system_types:
-                    for r in entity['role']:
-                        if 'attacker' == r.lower() or 'victim' ==r.lower():
-                            risk_object['risk_object_type'] = 'system'
-                            risk_object['risk_object_field'] = entity['name']
-                            risk_object['risk_score'] = self.security_content_obj.tags.risk_score
-                            risk_objects.append(risk_object)
-                else:
-                    risk_object['threat_object_field'] = entity['name']
-                    risk_object['threat_object_type'] = entity['type'].lower()
-                    risk_objects.append(risk_object)
-                    continue
+            if self.security_content_obj.tags.risk_score >= 80:
+                self.security_content_obj.tags.risk_severity = 'high'
+            elif (self.security_content_obj.tags.risk_score >= 50 and self.security_content_obj.tags.risk_score <= 79):
+                self.security_content_obj.tags.risk_severity = 'medium'
+            else:
+                self.security_content_obj.tags.risk_severity = 'low'
 
-        if self.security_content_obj.tags.risk_score >= 80:
-            self.security_content_obj.tags.risk_severity = 'high'
-        elif (self.security_content_obj.tags.risk_score >= 50 and self.security_content_obj.tags.risk_score <= 79):
-            self.security_content_obj.tags.risk_severity = 'medium'
-        else:
-            self.security_content_obj.tags.risk_severity = 'low'
-
-        self.security_content_obj.risk = risk_objects
+            self.security_content_obj.risk = risk_objects
 
 
     def addNesFields(self) -> None:
-        nes_fields_matches = []
-        if self.security_content_obj.deployment:
-            if self.security_content_obj.deployment.notable:
-                for nes_field in self.security_content_obj.deployment.notable.nes_fields:
-                    if (self.security_content_obj.search.find(nes_field + ' ') != -1):
-                        nes_fields_matches.append(nes_field)
-            
-                self.security_content_obj.deployment.notable.nes_fields = nes_fields_matches
+        if self.security_content_obj:
+            nes_fields_matches = []
+            if self.security_content_obj.deployment:
+                if self.security_content_obj.deployment.notable:
+                    for nes_field in self.security_content_obj.deployment.notable.nes_fields:
+                        if (self.security_content_obj.search.find(nes_field + ' ') != -1):
+                            nes_fields_matches.append(nes_field)
+                
+                    self.security_content_obj.deployment.notable.nes_fields = nes_fields_matches
 
 
     def addMappings(self) -> None:
-        keys = ['mitre_attack', 'kill_chain_phases', 'cis20', 'nist']
-        mappings = {}
-        for key in keys:
-            if key == 'mitre_attack':
-                if getattr(self.security_content_obj.tags, 'mitre_attack_id'):
-                    mappings[key] = getattr(self.security_content_obj.tags, 'mitre_attack_id')
-            elif getattr(self.security_content_obj.tags, key):
-                mappings[key] = getattr(self.security_content_obj.tags, key)
-        self.security_content_obj.mappings = mappings
+        if self.security_content_obj:
+            keys = ['mitre_attack', 'kill_chain_phases', 'cis20', 'nist']
+            mappings = {}
+            for key in keys:
+                if key == 'mitre_attack':
+                    if getattr(self.security_content_obj.tags, 'mitre_attack_id'):
+                        mappings[key] = getattr(self.security_content_obj.tags, 'mitre_attack_id')
+                elif getattr(self.security_content_obj.tags, key):
+                    mappings[key] = getattr(self.security_content_obj.tags, key)
+            self.security_content_obj.mappings = mappings
 
 
     def addAnnotations(self) -> None:
-        annotations = {}
-        annotation_keys = ['mitre_attack', 'kill_chain_phases', 'cis20', 'nist', 
-            'analytic_story', 'observable', 'context', 'impact', 'confidence', 'cve']
-        for key in annotation_keys:
-            if key == 'mitre_attack':
-                if getattr(self.security_content_obj.tags, 'mitre_attack_id'):
-                    annotations[key] = getattr(self.security_content_obj.tags, 'mitre_attack_id')
-            try:
-                if getattr(self.security_content_obj.tags, key):
-                    annotations[key] = getattr(self.security_content_obj.tags, key)
-            except AttributeError as e:
-                continue
-        self.security_content_obj.annotations = annotations    
+        if self.security_content_obj:
+            annotations = {}
+            annotation_keys = ['mitre_attack', 'kill_chain_phases', 'cis20', 'nist', 
+                'analytic_story', 'observable', 'context', 'impact', 'confidence', 'cve']
+            for key in annotation_keys:
+                if key == 'mitre_attack':
+                    if getattr(self.security_content_obj.tags, 'mitre_attack_id'):
+                        annotations[key] = getattr(self.security_content_obj.tags, 'mitre_attack_id')
+                try:
+                    if getattr(self.security_content_obj.tags, key):
+                        annotations[key] = getattr(self.security_content_obj.tags, key)
+                except AttributeError as e:
+                    continue
+            self.security_content_obj.annotations = annotations    
 
 
     def addPlaybook(self, playbooks: list) -> None:
-        matched_playbooks = []
-        for playbook in playbooks:
-            if playbook.tags.detections:
-                for detection in playbook.tags.detections:
-                    if detection == self.security_content_obj.name:
-                        matched_playbooks.append(playbook)
+        if self.security_content_obj:
+            matched_playbooks = []
+            for playbook in playbooks:
+                if playbook.tags.detections:
+                    for detection in playbook.tags.detections:
+                        if detection == self.security_content_obj.name:
+                            matched_playbooks.append(playbook)
 
-        self.security_content_obj.playbooks = matched_playbooks
+            self.security_content_obj.playbooks = matched_playbooks
 
 
     def addBaseline(self, baselines: list) -> None:
-        matched_baselines = []
-        for baseline in baselines:
-            for detection in baseline.tags.detections:
-                if detection == self.security_content_obj.name:
-                    matched_baselines.append(baseline)
+        if self.security_content_obj:
+            matched_baselines = []
+            for baseline in baselines:
+                for detection in baseline.tags.detections:
+                    if detection == self.security_content_obj.name:
+                        matched_baselines.append(baseline)
 
-        self.security_content_obj.baselines = matched_baselines
+            self.security_content_obj.baselines = matched_baselines
 
 
     def addUnitTest(self, tests: list) -> None:
-        for test in tests:
-            if test.tests[0].name == self.security_content_obj.name:
-                self.security_content_obj.test = test
-                return
+        if self.security_content_obj:
+            for test in tests:
+                if test.tests[0].name == self.security_content_obj.name:
+                    self.security_content_obj.test = test
+                    return
 
 
     def addMitreAttackEnrichment(self, attack_enrichment: dict) -> None:
-        if attack_enrichment:
-            if self.security_content_obj.tags.mitre_attack_id:
-                self.security_content_obj.tags.mitre_attack_enrichments = []
-                for mitre_attack_id in self.security_content_obj.tags.mitre_attack_id:
-                    if mitre_attack_id in attack_enrichment:
-                        mitre_attack_enrichment = MitreAttackEnrichment(
-                            mitre_attack_id = mitre_attack_id, 
-                            mitre_attack_technique = attack_enrichment[mitre_attack_id]["technique"], 
-                            mitre_attack_tactics = sorted(attack_enrichment[mitre_attack_id]["tactics"]), 
-                            mitre_attack_groups = sorted(attack_enrichment[mitre_attack_id]["groups"])
-                        )
-                        self.security_content_obj.tags.mitre_attack_enrichments.append(mitre_attack_enrichment)
-                    else:
-                        raise ValueError("mitre_attack_id " + mitre_attack_id + " doesn't exist for detecction " + self.security_content_obj.name)
+        if self.security_content_obj:
+            if attack_enrichment:
+                if self.security_content_obj.tags.mitre_attack_id:
+                    self.security_content_obj.tags.mitre_attack_enrichments = []
+                    for mitre_attack_id in self.security_content_obj.tags.mitre_attack_id:
+                        if mitre_attack_id in attack_enrichment:
+                            mitre_attack_enrichment = MitreAttackEnrichment(
+                                mitre_attack_id = mitre_attack_id, 
+                                mitre_attack_technique = attack_enrichment[mitre_attack_id]["technique"], 
+                                mitre_attack_tactics = sorted(attack_enrichment[mitre_attack_id]["tactics"]), 
+                                mitre_attack_groups = sorted(attack_enrichment[mitre_attack_id]["groups"])
+                            )
+                            self.security_content_obj.tags.mitre_attack_enrichments.append(mitre_attack_enrichment)
+                        else:
+                            raise ValueError("mitre_attack_id " + mitre_attack_id + " doesn't exist for detecction " + self.security_content_obj.name)
 
 
     def addMacros(self, macros: list) -> None:
-        macros_found = re.findall(r'`([^\s]+)`', self.security_content_obj.search)
-        macros_filtered = set()
-        self.security_content_obj.macros = []
+        if self.security_content_obj:
+            macros_found = re.findall(r'`([^\s]+)`', self.security_content_obj.search)
+            macros_filtered = set()
+            self.security_content_obj.macros = []
 
-        for macro in macros_found:
-            if not '_filter' in macro and not 'drop_dm_object_name' in macro:
-                start = macro.find('(')
-                if start != -1:
-                    macros_filtered.add(macro[:start])
-                else:
-                    macros_filtered.add(macro)
+            for macro in macros_found:
+                if not '_filter' in macro and not 'drop_dm_object_name' in macro:
+                    start = macro.find('(')
+                    if start != -1:
+                        macros_filtered.add(macro[:start])
+                    else:
+                        macros_filtered.add(macro)
 
-        for macro_name in macros_filtered:
-            for macro in macros:
-                if macro_name == macro.name:
-                    self.security_content_obj.macros.append(macro)
+            for macro_name in macros_filtered:
+                for macro in macros:
+                    if macro_name == macro.name:
+                        self.security_content_obj.macros.append(macro)
 
-        name = self.security_content_obj.name.replace(' ', '_').replace('-', '_').replace('.', '_').replace('/', '_').lower() + '_filter'
-        macro = Macro(name=name, definition='search *', description='Update this macro to limit the output results to filter out false positives.')
-        
-        self.security_content_obj.macros.append(macro)
+            name = self.security_content_obj.name.replace(' ', '_').replace('-', '_').replace('.', '_').replace('/', '_').lower() + '_filter'
+            macro = Macro(name=name, definition='search *', description='Update this macro to limit the output results to filter out false positives.')
+            
+            self.security_content_obj.macros.append(macro)
 
 
     def addLookups(self, lookups: list) -> None:
-        lookups_found = re.findall(r'lookup (?:update=true)?(?:append=t)?\s*([^\s]*)', self.security_content_obj.search)
-        self.security_content_obj.lookups = []
-        for lookup_name in lookups_found:
-            for lookup in lookups:
-                if lookup.name == lookup_name:
-                    self.security_content_obj.lookups.append(lookup)
+        if self.security_content_obj:
+            lookups_found = re.findall(r'lookup (?:update=true)?(?:append=t)?\s*([^\s]*)', self.security_content_obj.search)
+            self.security_content_obj.lookups = []
+            for lookup_name in lookups_found:
+                for lookup in lookups:
+                    if lookup.name == lookup_name:
+                        self.security_content_obj.lookups.append(lookup)
 
 
     def addCve(self) -> None:
-        self.security_content_obj.cve_enrichment = []
-        if self.security_content_obj.tags.cve:
-            for cve in self.security_content_obj.tags.cve:
-                self.security_content_obj.cve_enrichment.append(CveEnrichment.enrich_cve(cve))
+        if self.security_content_obj:
+            self.security_content_obj.cve_enrichment = []
+            if self.security_content_obj.tags.cve:
+                for cve in self.security_content_obj.tags.cve:
+                    self.security_content_obj.cve_enrichment.append(CveEnrichment.enrich_cve(cve))
 
 
     def reset(self) -> None:

bin/contentctl_project/contentctl_infrastructure/builder/security_content_director.py

@@ -59,10 +59,10 @@ class SecurityContentDirector(Director):
         builder.setObject(os.path.join(os.path.dirname(__file__), path), SecurityContentType.macros)
 
 
-    def constructPlaybook(self, builder: PlaybookBuilder, path: str, detections: list) -> None:
+    def constructPlaybook(self, builder: PlaybookBuilder, path: str) -> None:
         builder.reset()
         builder.setObject(os.path.join(os.path.dirname(__file__), path))
-        builder.addDetections(detections)
+        builder.addDetections()
 
 
     def constructTest(self, builder: BasicBuilder, path: str) -> None:

bin/contentctl_project/contentctl_infrastructure/builder/security_content_playbook_builder.py

@@ -1,7 +1,9 @@
 
 import sys
+import os
 
 from pydantic import ValidationError
+from pathlib import Path
 
 from bin.contentctl_project.contentctl_core.application.builder.playbook_builder import PlaybookBuilder
 from bin.contentctl_project.contentctl_core.domain.entities.playbook import Playbook
@@ -22,13 +24,16 @@ class SecurityContentPlaybookBuilder(PlaybookBuilder):
             sys.exit(1)
 
 
-    def addDetections(self, detections : list) -> None:
-        if detections:
-            if self.playbook.tags.detections:
-                self.playbook.tags.detection_objects = []
-                for detection in detections:
-                    if detection.name in self.playbook.tags.detections:
-                        self.playbook.tags.detection_objects.append(detection)
+    def addDetections(self) -> None:
+        if self.playbook.tags.detections:
+            self.playbook.tags.detection_objects = []
+            for detection in self.playbook.tags.detections:
+                detection_object = {
+                    "name": detection,
+                    "lowercase_name": self.convertNameToFileName(detection),
+                    "path": self.findDetectionPath(detection)
+                }
+                self.playbook.tags.detection_objects.append(detection_object)
 
 
     def reset(self) -> None:
@@ -36,4 +41,22 @@ class SecurityContentPlaybookBuilder(PlaybookBuilder):
 
 
     def getObject(self) -> Playbook:
-        return self.playbook
+        return self.playbook
+
+
+    def convertNameToFileName(self, name: str):
+        file_name = name \
+            .replace(' ', '_') \
+            .replace('-','_') \
+            .replace('.','_') \
+            .replace('/','_') \
+            .lower()
+        return file_name
+
+
+    def findDetectionPath(self, detection_name: str) -> str:
+        for path in Path(os.path.join(os.path.dirname(__file__), '../../../../detections')).rglob(self.convertNameToFileName(detection_name) + '.yml'):
+            normalized_path = os.path.normpath(path)
+            path_components = normalized_path.split(os.sep)
+            value_index = path_components.index('detections')
+            return "/".join(path_components[value_index:])

bin/contentctl_project/contentctl_infrastructure/builder/security_content_story_builder.py

@@ -37,19 +37,20 @@ class SecurityContentStoryBuilder(StoryBuilder):
         kill_chain_phases = set()
 
         for detection in detections:
-            for detection_analytic_story in detection.tags.analytic_story:
-                if detection_analytic_story == self.story.name:
-                    matched_detection_names.append(str('ESCU - ' + detection.name + ' - Rule'))
-                    matched_detections.append(detection)
-                    datamodels.update(detection.datamodel)
-                    if detection.tags.kill_chain_phases:
-                        kill_chain_phases.update(detection.tags.kill_chain_phases)
+            if detection:
+                for detection_analytic_story in detection.tags.analytic_story:
+                    if detection_analytic_story == self.story.name:
+                        matched_detection_names.append(str('ESCU - ' + detection.name + ' - Rule'))
+                        matched_detections.append(detection)
+                        datamodels.update(detection.datamodel)
+                        if detection.tags.kill_chain_phases:
+                            kill_chain_phases.update(detection.tags.kill_chain_phases)
 
-                    if detection.tags.mitre_attack_enrichments:
-                        for attack_enrichment in detection.tags.mitre_attack_enrichments:
-                            mitre_attack_tactics.update(attack_enrichment.mitre_attack_tactics)
-                            if attack_enrichment.mitre_attack_id not in [attack.mitre_attack_id for attack in mitre_attack_enrichments]:
-                                mitre_attack_enrichments.append(attack_enrichment)
+                        if detection.tags.mitre_attack_enrichments:
+                            for attack_enrichment in detection.tags.mitre_attack_enrichments:
+                                mitre_attack_tactics.update(attack_enrichment.mitre_attack_tactics)
+                                if attack_enrichment.mitre_attack_id not in [attack.mitre_attack_id for attack in mitre_attack_enrichments]:
+                                    mitre_attack_enrichments.append(attack_enrichment)
 
         self.story.detection_names = matched_detection_names
         self.story.detections = matched_detections

bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/stories.json

@@ -364,6 +364,13 @@
                             ],
                             "product": [
                                 "Splunk SOAR"
+                            ],
+                            "detection_objects": [
+                                {
+                                    "name": "Attempted Credential Dump From Registry via Reg exe",
+                                    "lowercase_name": "attempted_credential_dump_from_registry_via_reg_exe",
+                                    "path": "detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml"
+                                }
                             ]
                         }
                     }

bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data/_pages/paybooks.md

@@ -10,4 +10,4 @@ sidebar:
 
 | Name    | Detections | Type        |
 | --------| ---------- | ----------- |
-| [Ransomware Investigate and Contain](/playbooks/ransomware_investigate_and_contain/)|[Attempted Credential Dump From Registry via Reg exe](/detection/attempted_credential_dump_from_registry_via_reg_exe/)| Response |
+| [Ransomware Investigate and Contain](/playbooks/ransomware_investigate_and_contain/)|[Attempted Credential Dump From Registry via Reg exe]((/detection/attempted_credential_dump_from_registry_via_reg_exe/)| Response |

bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data/_playbooks/ransomware_investigate_and_contain.md

@@ -30,7 +30,7 @@ This playbook investigates and contains ransomware detected on endpoints.
 
 #### Associated Detections
 
-* [Attempted Credential Dump From Registry via Reg exe](//attempted_credential_dump_from_registry_via_reg_exe/)
+* [Attempted Credential Dump From Registry via Reg exe](/detection/attempted_credential_dump_from_registry_via_reg_exe/)
 
 
 

bin/contentctl_project/contentctl_infrastructure/tests/adapter/test_obj_to_attack_nav_adapter.py

@@ -48,7 +48,7 @@ def test_svg_writer():
 
     playbook_builder = SecurityContentPlaybookBuilder()
     director.constructPlaybook(playbook_builder, os.path.join(os.path.dirname(__file__), 
-        '../builder/test_data/playbook/example_playbook.yml'), [])
+        '../builder/test_data/playbook/example_playbook.yml'))
     playbook = playbook_builder.getObject()
 
     detection_builder = SecurityContentDetectionBuilder()

bin/contentctl_project/contentctl_infrastructure/tests/adapter/test_obj_to_conf_adapter.py

@@ -52,7 +52,7 @@ def test_write_conf_files(patch_datetime_now):
 
     playbook_builder = SecurityContentPlaybookBuilder()
     director.constructPlaybook(playbook_builder, os.path.join(os.path.dirname(__file__), 
-        '../builder/test_data/playbook/example_playbook.yml'), [])
+        '../builder/test_data/playbook/example_playbook.yml'))
     playbook = playbook_builder.getObject()    
 
     baseline_builder = SecurityContentBaselineBuilder()

bin/contentctl_project/contentctl_infrastructure/tests/adapter/test_obj_to_json_adapter.py

@@ -143,7 +143,7 @@ def test_write_stories():
 
     playbook_builder = SecurityContentPlaybookBuilder()
     director.constructPlaybook(playbook_builder, os.path.join(os.path.dirname(__file__), 
-        '../builder/test_data/playbook/example_playbook.yml'), [])
+        '../builder/test_data/playbook/example_playbook.yml'))
     playbook = playbook_builder.getObject()    
 
     baseline_builder = SecurityContentBaselineBuilder()

bin/contentctl_project/contentctl_infrastructure/tests/adapter/test_obj_to_md_adapter.py

@@ -48,7 +48,7 @@ def test_md_writer():
 
     playbook_builder = SecurityContentPlaybookBuilder()
     director.constructPlaybook(playbook_builder, os.path.join(os.path.dirname(__file__), 
-        '../builder/test_data/playbook/example_playbook.yml'), [])
+        '../builder/test_data/playbook/example_playbook.yml'))
     playbook = playbook_builder.getObject()
 
     detection_builder = SecurityContentDetectionBuilder()
@@ -64,7 +64,7 @@ def test_md_writer():
 
     playbook_builder = SecurityContentPlaybookBuilder()
     director.constructPlaybook(playbook_builder, os.path.join(os.path.dirname(__file__), 
-        '../builder/test_data/playbook/example_playbook.yml'), [detection])
+        '../builder/test_data/playbook/example_playbook.yml'))
     playbook = playbook_builder.getObject()    
 
     investigation_builder = SecurityContentInvestigationBuilder()

bin/contentctl_project/contentctl_infrastructure/tests/adapter/test_obj_to_svg_adapter.py

@@ -48,7 +48,7 @@ def test_svg_writer():
 
     playbook_builder = SecurityContentPlaybookBuilder()
     director.constructPlaybook(playbook_builder, os.path.join(os.path.dirname(__file__), 
-        '../builder/test_data/playbook/example_playbook.yml'), [])
+        '../builder/test_data/playbook/example_playbook.yml'))
     playbook = playbook_builder.getObject()
 
     detection_builder = SecurityContentDetectionBuilder()

bin/contentctl_project/contentctl_infrastructure/tests/builder/test_security_content_director.py

@@ -50,7 +50,7 @@ def test_construct_playbooks():
     director = SecurityContentDirector()
     playbook_builder = SecurityContentPlaybookBuilder()
     director.constructPlaybook(playbook_builder, os.path.join(os.path.dirname(__file__), 
-        'test_data/playbook/example_playbook.yml'), [])
+        'test_data/playbook/example_playbook.yml'))
     playbook = playbook_builder.getObject()     
 
     assert playbook.name == "Ransomware Investigate and Contain"
@@ -120,7 +120,7 @@ def test_construct_detections():
 
     playbook_builder = SecurityContentPlaybookBuilder()
     director.constructPlaybook(playbook_builder, os.path.join(os.path.dirname(__file__), 
-        'test_data/playbook/example_playbook.yml'), [])
+        'test_data/playbook/example_playbook.yml'))
     playbook = playbook_builder.getObject()    
 
     baseline_builder = SecurityContentBaselineBuilder()
@@ -188,7 +188,7 @@ def test_construct_stories():
 
     playbook_builder = SecurityContentPlaybookBuilder()
     director.constructPlaybook(playbook_builder, os.path.join(os.path.dirname(__file__), 
-        'test_data/playbook/example_playbook.yml'), [])
+        'test_data/playbook/example_playbook.yml'))
     playbook = playbook_builder.getObject()    
 
     baseline_builder = SecurityContentBaselineBuilder()

bin/contentctl_project/contentctl_infrastructure/tests/builder/test_security_content_playbook_builder.py

@@ -14,15 +14,11 @@ def test_read_playbook():
 
 
 def test_enrich_detections():
-    security_content_builder = SecurityContentDetectionBuilder()
-    security_content_builder.setObject(os.path.join(os.path.dirname(__file__), 
-        'test_data/detection/valid.yml'))
-    detection = security_content_builder.getObject()
 
     playbook_builder = SecurityContentPlaybookBuilder()
     playbook_builder.setObject(os.path.join(os.path.dirname(__file__), 
         'test_data/playbook/example_playbook.yml'))
-    playbook_builder.addDetections([detection])
+    playbook_builder.addDetections()
     playbook = playbook_builder.getObject()
 
-    assert playbook.tags.detection_objects[0].name == "Attempted Credential Dump From Registry via Reg exe"
+    assert playbook.tags.detection_objects[0]['path'] == "detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml"

contentctl.py

@@ -33,7 +33,7 @@ from bin.contentctl_project.contentctl_infrastructure.builder.attack_enrichment
 from bin.contentctl_project.contentctl_core.domain.entities.enums.enums import SecurityContentType
 
 
-def init(args):
+def init():
 
     print("""
 Running Splunk Security Content Control Tool (contentctl) 
@@ -65,16 +65,6 @@ starting program loaded for TIE Fighter...
 
     """)
 
-    # parse config
-    security_content_path = os.path(args.path).resolve()
-    if security_content_path.is_dir():
-        print("contentctl is reading from path {0}".format(
-            security_content_path))
-    else:
-        print("ERROR: contentctl failed to find security_content project")
-        sys.exit(1)
-    return str(security_content_path)
-
 
 def content_changer(args) -> None:
     factory_input_dto = ObjectFactoryInputDto(
@@ -155,8 +145,8 @@ def validate(args) -> None:
         print("ERROR: missing parameter -p/--product .")
         sys.exit(1)     
 
-    if args.product not in ['ESCU', 'SSA']:
-        print("ERROR: invalid product. valid products are ESCU, SSA or API.")
+    if args.product not in ['ESCU', 'SSA', 'all']:
+        print("ERROR: invalid product. valid products are all, ESCU or SSA.")
         sys.exit(1)
 
     factory_input_dto = FactoryInputDto(
@@ -178,21 +168,24 @@ def validate(args) -> None:
         SecurityContentDirector()
     )
 
-    if args.product == "ESCU":
+    if args.product == "ESCU" or args.product == "all":
         validate_input_dto = ValidateInputDto(
             factory_input_dto,
             ba_factory_input_dto,
             SecurityContentProduct.ESCU
         )
-    elif args.product == "SSA":
+        validate = Validate()
+        validate.execute(validate_input_dto)
+
+    if args.product == "SSA" or args.product == "all":
         validate_input_dto = ValidateInputDto(
             factory_input_dto,
             ba_factory_input_dto,
             SecurityContentProduct.SSA
         )
+        validate = Validate()
+        validate.execute(validate_input_dto)
 
-    validate = Validate()
-    validate.execute(validate_input_dto)
 
 
 def doc_gen(args) -> None:
@@ -258,6 +251,8 @@ def reporting(args) -> None:
 
 def main(args):
 
+    init()
+
     # grab arguments
     parser = argparse.ArgumentParser(
         description="Use `contentctl.py action -h` to get help with any Splunk Security Content action")
@@ -281,8 +276,8 @@ def main(args):
     #                              help="Generates an example content UPDATE on the fields that need updating. Use `git status` to see what specific files are added. Skips new content wizard prompts.")
     # new_parser.set_defaults(func=new)
 
-    validate_parser.add_argument("-pr", "--product", required=True, type=str,
-        help="Type of package to create, choose between `ESCU` or `SSA`.")
+    validate_parser.add_argument("-pr", "--product", required=True, type=str, default='all', 
+        help="Type of package to create, choose between all, `ESCU` or `SSA`.")
     validate_parser.set_defaults(func=validate, epilog="""
                 Validates security manifest for correctness, adhering to spec and other common items.""")
 

dist/escu/default/analyticstories.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-15T15:18:01 UTC
+# On Date: 2022-03-21T07:44:43 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1217,7 +1217,7 @@ annotations = {"kill_chain_phases": ["Exploitation"]}
 known_false_positives = This search can give false positives as there might be inherent issues with authentications and permissions at cluster.
 providing_technologies = []
 
-[savedsearch://ESCU - Kubernetes Azure detect most active service accounts by pod namespace - Rule]
+[savedsearch://ESCU - Kubernetes Azure active service accounts by pod namespace - Rule]
 type = detection
 asset_type = Azure AKS Kubernetes cluster
 confidence = medium
@@ -1357,16 +1357,6 @@ annotations = {"kill_chain_phases": ["Exploitation"]}
 known_false_positives = Kubectl calls are not malicious by nature. However source IP, source user, user agent, object path, and authorization context can reveal potential malicious activity, specially anonymous suspicious IPs and sensitive objects such as configmaps or secrets
 providing_technologies = []
 
-[savedsearch://ESCU - Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments - Rule]
-type = detection
-asset_type = Endpoint
-confidence = medium
-explanation = This search looks for PowerShell processes started with a base64 encoded command-line passed to it, with parameters to modify the execution policy for the process, and those that prevent the display of an interactive prompt to the user. This combination of command-line options is suspicious because it overrides the default PowerShell execution policy, attempts to hide itself from the user, and passes an encoded script to be run on the command-line. Deprecated because almost the same as Malicious PowerShell Process - Encoded Command
-how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model.
-annotations = {"cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Command \u0026 Control", "Actions on Objectives"], "mitre_attack": ["T1059.001"], "nist": ["PR.PT", "DE.CM", "PR.IP"]}
-known_false_positives = Legitimate process can have this combination of command-line options, but it's not common.
-providing_technologies = []
-
 [savedsearch://ESCU - Monitor DNS For Brand Abuse - Rule]
 type = detection
 asset_type = Endpoint
@@ -1497,6 +1487,16 @@ annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"
 known_false_positives = It's possible for a legitimate file to be created with the same name as one noted in the lookup file. Filenames listed in the lookup file should be unique enough that collisions are rare. Looking at the location of the file and the process responsible for the activity can help determine whether or not the activity is legitimate.
 providing_technologies = []
 
+[savedsearch://ESCU - Suspicious Powershell Command-Line Arguments - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = This search looks for PowerShell processes started with a base64 encoded command-line passed to it, with parameters to modify the execution policy for the process, and those that prevent the display of an interactive prompt to the user. This combination of command-line options is suspicious because it overrides the default PowerShell execution policy, attempts to hide itself from the user, and passes an encoded script to be run on the command-line. Deprecated because almost the same as Malicious PowerShell Process - Encoded Command
+how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model.
+annotations = {"cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Command \u0026 Control", "Actions on Objectives"], "mitre_attack": ["T1059.001"], "nist": ["PR.PT", "DE.CM", "PR.IP"]}
+known_false_positives = Legitimate process can have this combination of command-line options, but it's not common.
+providing_technologies = []
+
 [savedsearch://ESCU - Suspicious Rundll32 Rename - Rule]
 type = detection
 asset_type = Endpoint
@@ -3224,6 +3224,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1489"]}
 known_false_positives = unknown
 providing_technologies = []
 
+[savedsearch://ESCU - Excessive distinct processes from Windows Temp - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = This analytic will identify suspicious series of process executions.  We have observed that post exploit framework tools like Koadic and Meterpreter will launch an excessive number of processes with distinct file paths from Windows\Temp to execute actions on objective.  This behavior is extremely anomalous compared to typical application behaviors that use Windows\Temp.
+how_to_implement = To successfully implement this search, you need to be ingesting logs with the full process path in the process field of CIM's Process data model. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed sc.exe may be used.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059"]}
+known_false_positives = Many benign applications will create processes from executables in Windows\Temp, although unlikely to exceed the given threshold.  Filter as needed.
+providing_technologies = []
+
 [savedsearch://ESCU - Excessive File Deletion In WinDefender Folder - Rule]
 type = detection
 asset_type = Endpoint
@@ -3234,16 +3244,6 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exp
 known_false_positives = Windows Defender AV updates may cause this alert. Please update the filter macros to remove false positives.
 providing_technologies = []
 
-[savedsearch://ESCU - Excessive number of distinct processes created in Windows Temp folder - Rule]
-type = detection
-asset_type = Endpoint
-confidence = medium
-explanation = This analytic will identify suspicious series of process executions.  We have observed that post exploit framework tools like Koadic and Meterpreter will launch an excessive number of processes with distinct file paths from Windows\Temp to execute actions on objective.  This behavior is extremely anomalous compared to typical application behaviors that use Windows\Temp.
-how_to_implement = To successfully implement this search, you need to be ingesting logs with the full process path in the process field of CIM's Process data model. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed sc.exe may be used.
-annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059"]}
-known_false_positives = Many benign applications will create processes from executables in Windows\Temp, although unlikely to exceed the given threshold.  Filter as needed.
-providing_technologies = []
-
 [savedsearch://ESCU - Excessive number of service control start as disabled - Rule]
 type = detection
 asset_type = Endpoint
@@ -4612,32 +4612,6 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1574.00
 known_false_positives = quite minimal false positive expected.
 providing_technologies = []
 
-[savedsearch://ESCU - Multiple Disabled Users Failing To Authenticate From Host Using Kerberos - Rule]
-type = detection
-asset_type = Endpoint
-confidence = medium
-explanation = The following analytic identifies one source endpoint failing to authenticate with multiple disabled domain users using the Kerberos protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using Kerberos to obtain initial access or elevate privileges. As attackers progress in a breach, mistakes will be made. In certain scenarios, adversaries may execute a password spraying attack against disabled users. Event 4768 is generated every time the Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT). Failure code `0x12` stands for `clients credentials have been revoked` (account disabled, expired or locked out).\
-The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\
-This detection will only trigger on domain controllers, not on member servers or workstations.\
-The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts.
-how_to_implement = To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
-annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003", "T1110"]}
-known_false_positives = A host failing to authenticate with multiple disabled domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners, multi-user systems missconfigured systems.
-providing_technologies = []
-
-[savedsearch://ESCU - Multiple Invalid Users Failing To Authenticate From Host Using Kerberos - Rule]
-type = detection
-asset_type = Endpoint
-confidence = medium
-explanation = The following analytic identifies one source endpoint failing to authenticate with multiple invalid domain users using the Kerberos protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using Kerberos to obtain initial access or elevate privileges. As attackers progress in a breach, mistakes will be made. In certain scenarios, adversaries may execute a password spraying attack using an invalid list of users. Event 4768 is generated every time the Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT). Failure code 0x6 stands for `client not found in Kerberos database` (the attempted user is not a valid domain user).\
-The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\
-This detection will only trigger on domain controllers, not on member servers or workstations.\
-The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts.
-how_to_implement = To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
-annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003", "T1110"]}
-known_false_positives = A host failing to authenticate with multiple invalid domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners, multi-user systems and missconfigured systems.
-providing_technologies = []
-
 [savedsearch://ESCU - Multiple Invalid Users Failing To Authenticate From Host Using NTLM - Rule]
 type = detection
 asset_type = Endpoint
@@ -4651,19 +4625,6 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.00
 known_false_positives = A host failing to authenticate with multiple invalid domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners and missconfigured systems. If this detection triggers on a host other than a Domain Controller, the behavior could represent a password spraying attack against the host's local accounts.
 providing_technologies = []
 
-[savedsearch://ESCU - Multiple Users Attempting To Authenticate Using Explicit Credentials - Rule]
-type = detection
-asset_type = Endpoint
-confidence = medium
-explanation = The following analytic identifies a source user failing to authenticate with multiple users using explicit credentials on a host. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment to obtain initial access or elevate privileges. Event 4648 is generated when a process attempts an account logon by explicitly specifying that accounts credentials. This event generates on domain controllers, member servers, and workstations.\
-The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\
-This detection will trigger on the potenfially malicious host, perhaps controlled via a trojan or operated by an insider threat, from where a password spraying attack is being executed.\
-The analytics returned fields allow analysts to investigate the event further by providing fields like source account, attempted user accounts and the endpoint were the behavior was identified.
-how_to_implement = To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers as well as member servers and workstations. The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs to be enabled.
-annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003", "T1110"]}
-known_false_positives = A source user failing attempting to authenticate multiple users on a host is not a common behavior for regular systems. Some applications, however, may exhibit this behavior in which case sets of users hosts can be added to an allow list. Possible false positive scenarios include systems where several users connect to like Mail servers, identity providers, remote desktop services, Citrix, etc.
-providing_technologies = []
-
 [savedsearch://ESCU - Multiple Users Failing To Authenticate From Host Using Kerberos - Rule]
 type = detection
 asset_type = Endpoint
@@ -5191,7 +5152,7 @@ annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069"
 known_false_positives = False positives may be present. Tune as needed.
 providing_technologies = []
 
-[savedsearch://ESCU - PowerShell Loading DotNET into Memory via System Reflection Assembly - Rule]
+[savedsearch://ESCU - PowerShell Loading DotNET into Memory via Reflection - Rule]
 type = detection
 asset_type = Endpoint
 confidence = medium
@@ -6891,6 +6852,19 @@ annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Delivery"], "mitre_att
 known_false_positives = It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search.
 providing_technologies = []
 
+[savedsearch://ESCU - Windows Disabled Users Failing To Authenticate Kerberos - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic identifies one source endpoint failing to authenticate with multiple disabled domain users using the Kerberos protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using Kerberos to obtain initial access or elevate privileges. As attackers progress in a breach, mistakes will be made. In certain scenarios, adversaries may execute a password spraying attack against disabled users. Event 4768 is generated every time the Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT). Failure code `0x12` stands for `clients credentials have been revoked` (account disabled, expired or locked out).\
+The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\
+This detection will only trigger on domain controllers, not on member servers or workstations.\
+The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts.
+how_to_implement = To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003", "T1110"]}
+known_false_positives = A host failing to authenticate with multiple disabled domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners, multi-user systems missconfigured systems.
+providing_technologies = []
+
 [savedsearch://ESCU - Windows DiskCryptor Usage - Rule]
 type = detection
 asset_type = Endpoint
@@ -7078,6 +7052,19 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.00
 known_false_positives = Limited false positives should be present as InstallUtil is not typically used to download remote files. Filter as needed based on Developers requirements.
 providing_technologies = []
 
+[savedsearch://ESCU - Windows Invalid Users Failed Authentication via Kerberos - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic identifies one source endpoint failing to authenticate with multiple invalid domain users using the Kerberos protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using Kerberos to obtain initial access or elevate privileges. As attackers progress in a breach, mistakes will be made. In certain scenarios, adversaries may execute a password spraying attack using an invalid list of users. Event 4768 is generated every time the Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT). Failure code 0x6 stands for `client not found in Kerberos database` (the attempted user is not a valid domain user).\
+The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\
+This detection will only trigger on domain controllers, not on member servers or workstations.\
+The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts.
+how_to_implement = To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003", "T1110"]}
+known_false_positives = A host failing to authenticate with multiple invalid domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners, multi-user systems and missconfigured systems.
+providing_technologies = []
+
 [savedsearch://ESCU - Windows Modify Show Compress Color And Info Tip Registry - Rule]
 type = detection
 asset_type = Endpoint
@@ -7262,6 +7249,19 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1543",
 known_false_positives = Administrators may start Windows Services on remote systems, but this activity is usually limited to a small set of hosts or users.
 providing_technologies = []
 
+[savedsearch://ESCU - Windows Users Authenticate Using Explicit Credentials - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic identifies a source user failing to authenticate with multiple users using explicit credentials on a host. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment to obtain initial access or elevate privileges. Event 4648 is generated when a process attempts an account logon by explicitly specifying that accounts credentials. This event generates on domain controllers, member servers, and workstations.\
+The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\
+This detection will trigger on the potenfially malicious host, perhaps controlled via a trojan or operated by an insider threat, from where a password spraying attack is being executed.\
+The analytics returned fields allow analysts to investigate the event further by providing fields like source account, attempted user accounts and the endpoint were the behavior was identified.
+how_to_implement = To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers as well as member servers and workstations. The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs to be enabled.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003", "T1110"]}
+known_false_positives = A source user failing attempting to authenticate multiple users on a host is not a common behavior for regular systems. Some applications, however, may exhibit this behavior in which case sets of users hosts can be added to an allow list. Possible false positive scenarios include systems where several users connect to like Mail servers, identity providers, remote desktop services, Citrix, etc.
+providing_technologies = []
+
 [savedsearch://ESCU - Windows WMI Process Call Create - Rule]
 type = detection
 asset_type = Endpoint
@@ -7958,7 +7958,7 @@ annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Installation", "Comman
 known_false_positives = At this stage, there are no known false positives. During testing, no process events refering the com.apple.loginwindow.plist files were observed during normal operation of re-opening applications on reboot. Therefore, it can be asumed that any occurences of this in the process events would be worth investigating. In the event that the legitimate modification by the system of these files is in fact logged to the process log, then the process_name of that process can be added to an allow list.
 providing_technologies = []
 
-[savedsearch://ESCU - Microsoft Exchange Mailbox Replication service writing Active Server Pages - Rule]
+[savedsearch://ESCU - MS Exchange Mailbox Replication service writing Active Server Pages - Rule]
 type = detection
 asset_type = Endpoint
 confidence = medium
@@ -8613,7 +8613,7 @@ version = 1
 references = ["https://en.wikipedia.org/wiki/Kerberos_(protocol)", "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-kile/2a32282e-dd48-4ad9-a542-609804b02cc9", "https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html", "https://stealthbits.com/blog/cracking-active-directory-passwords-with-as-rep-roasting/", "https://attack.mitre.org/techniques/T1558/003/", "https://attack.mitre.org/techniques/T1550/003/", "https://attack.mitre.org/techniques/T1558/004/"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Mauricio Velazco"}]
 spec_version = 3
-searches = ["ESCU - Disabled Kerberos Pre-Authentication Discovery With Get-ADUser - Rule", "ESCU - Disabled Kerberos Pre-Authentication Discovery With PowerView - Rule", "ESCU - Kerberoasting spn request with RC4 encryption - Rule", "ESCU - Kerberos Pre-Authentication Flag Disabled in UserAccountControl - Rule", "ESCU - Kerberos Pre-Authentication Flag Disabled with PowerShell - Rule", "ESCU - Mimikatz PassTheTicket CommandLine Parameters - Rule", "ESCU - Multiple Disabled Users Failing To Authenticate From Host Using Kerberos - Rule", "ESCU - Multiple Invalid Users Failing To Authenticate From Host Using Kerberos - Rule", "ESCU - Multiple Users Failing To Authenticate From Host Using Kerberos - Rule", "ESCU - Rubeus Command Line Parameters - Rule", "ESCU - Rubeus Kerberos Ticket Exports Through Winlogon Access - Rule", "ESCU - ServicePrincipalNames Discovery with PowerShell - Rule", "ESCU - ServicePrincipalNames Discovery with SetSPN - Rule", "ESCU - Unusual Number of Kerberos Service Tickets Requested - Rule"]
+searches = ["ESCU - Disabled Kerberos Pre-Authentication Discovery With Get-ADUser - Rule", "ESCU - Disabled Kerberos Pre-Authentication Discovery With PowerView - Rule", "ESCU - Kerberoasting spn request with RC4 encryption - Rule", "ESCU - Kerberos Pre-Authentication Flag Disabled in UserAccountControl - Rule", "ESCU - Kerberos Pre-Authentication Flag Disabled with PowerShell - Rule", "ESCU - Mimikatz PassTheTicket CommandLine Parameters - Rule", "ESCU - Multiple Users Failing To Authenticate From Host Using Kerberos - Rule", "ESCU - Rubeus Command Line Parameters - Rule", "ESCU - Rubeus Kerberos Ticket Exports Through Winlogon Access - Rule", "ESCU - ServicePrincipalNames Discovery with PowerShell - Rule", "ESCU - ServicePrincipalNames Discovery with SetSPN - Rule", "ESCU - Unusual Number of Kerberos Service Tickets Requested - Rule", "ESCU - Windows Disabled Users Failing To Authenticate Kerberos - Rule", "ESCU - Windows Invalid Users Failed Authentication via Kerberos - Rule"]
 description = Monitor for activities and techniques associated with Kerberos based attacks within with Active Directory environments.
 narrative = Kerberos, initially named after Cerberus, the three-headed dog in Greek mythology, is a network authentication protocol that allows computers and users to prove their identity through a trusted third-party. This trusted third-party issues Kerberos tickets using symmetric encryption to allow users access to services and network resources based on their privilege level. Kerberos is the default authentication protocol used on Windows Active Directory networks since the introduction of Windows Server 2003. With Kerberos being the backbone of Windows authentication, it is commonly abused by adversaries across the different phases of a breach including initial access, privilege escalation, defense evasion, credential access, lateral movement, etc.\ This Analytic Story groups detection use cases in which the Kerberos protocol is abused. Defenders can leverage these analytics to detect and hunt for adversaries engaging in Kerberos based attacks.
 
@@ -8639,7 +8639,7 @@ version = 1
 references = ["https://attack.mitre.org/techniques/T1110/003/", "https://www.microsoft.com/security/blog/2020/04/23/protecting-organization-password-spray-attacks/", "https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn452415(v=ws.11)"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Mauricio Velazco"}]
 spec_version = 3
-searches = ["ESCU - Multiple Disabled Users Failing To Authenticate From Host Using Kerberos - Rule", "ESCU - Multiple Invalid Users Failing To Authenticate From Host Using Kerberos - Rule", "ESCU - Multiple Invalid Users Failing To Authenticate From Host Using NTLM - Rule", "ESCU - Multiple Users Attempting To Authenticate Using Explicit Credentials - Rule", "ESCU - Multiple Users Failing To Authenticate From Host Using Kerberos - Rule", "ESCU - Multiple Users Failing To Authenticate From Host Using NTLM - Rule", "ESCU - Multiple Users Failing To Authenticate From Process - Rule", "ESCU - Multiple Users Remotely Failing To Authenticate From Host - Rule"]
+searches = ["ESCU - Multiple Invalid Users Failing To Authenticate From Host Using NTLM - Rule", "ESCU - Multiple Users Failing To Authenticate From Host Using Kerberos - Rule", "ESCU - Multiple Users Failing To Authenticate From Host Using NTLM - Rule", "ESCU - Multiple Users Failing To Authenticate From Process - Rule", "ESCU - Multiple Users Remotely Failing To Authenticate From Host - Rule", "ESCU - Windows Disabled Users Failing To Authenticate Kerberos - Rule", "ESCU - Windows Invalid Users Failed Authentication via Kerberos - Rule", "ESCU - Windows Users Authenticate Using Explicit Credentials - Rule"]
 description = Monitor for activities and techniques associated with Password Spraying attacks within Active Directory environments.
 narrative = In a password spraying attack, adversaries leverage one or a small list of commonly used / popular passwords against a large volume of usernames to acquire valid account credentials. Unlike a Brute Force attack that targets a specific user or small group of users with a large number of passwords, password spraying follows the opposite aproach and increases the chances of obtaining valid credentials while avoiding account lockouts. This allows adversaries to remain undetected if the target organization does not have the proper monitoring and detection controls in place.\
 Password Spraying can be leveraged by adversaries across different stages in an attack. It can be used to obtain an iniial access to an environment but can also be used to escalate privileges when access has been already achieved. In some scenarios, this technique capitalizes on a security policy most organizations implement, password rotation. As enterprise users change their passwords, it is possible some pick predictable, seasonal passwords such as `$CompanyNameWinter`, `Summer2021`, etc.\
@@ -8983,7 +8983,7 @@ version = 1
 references = ["https://www.splunk.com/en_us/blog/security/approaching-kubernetes-security-detecting-kubernetes-scan-with-splunk.html"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Rod Soto"}]
 spec_version = 3
-searches = ["ESCU - Kubernetes AWS detect most active service accounts by pod - Rule", "ESCU - Kubernetes AWS detect RBAC authorization by account - Rule", "ESCU - Kubernetes AWS detect sensitive role access - Rule", "ESCU - Kubernetes Azure detect most active service accounts by pod namespace - Rule", "ESCU - Kubernetes Azure detect RBAC authorization by account - Rule", "ESCU - Kubernetes Azure detect sensitive role access - Rule", "ESCU - Kubernetes GCP detect RBAC authorizations by account - Rule", "ESCU - Kubernetes GCP detect most active service accounts by pod - Rule", "ESCU - Kubernetes GCP detect sensitive role access - Rule", "ESCU - Get Notable History - Response Task"]
+searches = ["ESCU - Kubernetes AWS detect most active service accounts by pod - Rule", "ESCU - Kubernetes AWS detect RBAC authorization by account - Rule", "ESCU - Kubernetes AWS detect sensitive role access - Rule", "ESCU - Kubernetes Azure active service accounts by pod namespace - Rule", "ESCU - Kubernetes Azure detect RBAC authorization by account - Rule", "ESCU - Kubernetes Azure detect sensitive role access - Rule", "ESCU - Kubernetes GCP detect RBAC authorizations by account - Rule", "ESCU - Kubernetes GCP detect most active service accounts by pod - Rule", "ESCU - Kubernetes GCP detect sensitive role access - Rule", "ESCU - Get Notable History - Response Task"]
 description = This story addresses detection and response around Sensitive Role usage within a Kubernetes clusters against cluster resources and namespaces.
 narrative = Kubernetes is the most used container orchestration platform, this orchestration platform contains sensitive roles within its architecture, specifically configmaps and secrets, if accessed by an attacker can lead to further compromise. These searches allow operator to detect suspicious requests against Kubernetes role activities
 
@@ -9395,14 +9395,14 @@ narrative = Privilege escalation is a "land-and-expand" technique, wherein an ad
 
 [analytic_story://Living Off The Land]
 category = Adversary Tactics
-last_updated = 2022-02-17
-version = 1
+last_updated = 2022-03-16
+version = 2
 references = ["https://lolbas-project.github.io/"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Lou Stella"}]
 spec_version = 3
-searches = ["ESCU - Eventvwr UAC Bypass - Rule", "ESCU - MacOS LOLbin - Rule", "ESCU - Windows Diskshadow Proxy Execution - Rule", "ESCU - WSReset UAC Bypass - Rule"]
-description = Leverage searches that allow you to search for the presence of an attacker leveraging existing tooling within your environment.
-narrative = Living Off The Land refers to an attacker methodology of using software already installed on their target host to achieve their goals. Many utilities that ship with Windows can be used to achieve various goals, with reduced chances of detection by an antivirus software.
+searches = ["ESCU - BITS Job Persistence - Rule", "ESCU - BITSAdmin Download File - Rule", "ESCU - CertUtil Download With URLCache and Split Arguments - Rule", "ESCU - CertUtil Download With VerifyCtl and Split Arguments - Rule", "ESCU - Certutil exe certificate extraction - Rule", "ESCU - CertUtil With Decode Argument - Rule", "ESCU - CMD Carry Out String Command Parameter - Rule", "ESCU - Control Loading from World Writable Directory - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Detect HTML Help Renamed - Rule", "ESCU - Detect HTML Help Spawn Child Process - Rule", "ESCU - Detect HTML Help URL in Command Line - Rule", "ESCU - Detect HTML Help Using InfoTech Storage Handlers - Rule", "ESCU - Detect mshta inline hta execution - Rule", "ESCU - Detect mshta renamed - Rule", "ESCU - Detect MSHTA Url in Command Line - Rule", "ESCU - Detect Regasm Spawning a Process - Rule", "ESCU - Detect Regasm with Network Connection - Rule", "ESCU - Detect Regasm with no Command Line Arguments - Rule", "ESCU - Detect Regsvcs Spawning a Process - Rule", "ESCU - Detect Regsvcs with Network Connection - Rule", "ESCU - Detect Regsvcs with No Command Line Arguments - Rule", "ESCU - Detect Regsvr32 Application Control Bypass - Rule", "ESCU - Detect Rundll32 Application Control Bypass - advpack - Rule", "ESCU - Detect Rundll32 Application Control Bypass - setupapi - Rule", "ESCU - Detect Rundll32 Application Control Bypass - syssetup - Rule", "ESCU - Detect Rundll32 Inline HTA Execution - Rule", "ESCU - Disable Schedule Task - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Esentutl SAM Copy - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - MacOS LOLbin - Rule", "ESCU - Mmc LOLBAS Execution Process Spawn - Rule", "ESCU - Mshta spawning Rundll32 OR Regsvr32 Process - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Regsvr32 Silent and Install Param Dll Loading - Rule", "ESCU - Regsvr32 with Known Silent Switch Cmdline - Rule", "ESCU - Remote WMI Command Attempt - Rule", "ESCU - Rundll32 Control RunDLL Hunt - Rule", "ESCU - Rundll32 Control RunDLL World Writable Directory - Rule", "ESCU - Rundll32 Create Remote Thread To A Process - Rule", "ESCU - Rundll32 CreateRemoteThread In Browser - Rule", "ESCU - Rundll32 DNSQuery - Rule", "ESCU - Rundll32 Process Creating Exe Dll Files - Rule", "ESCU - Rundll32 Shimcache Flush - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - Schedule Task with HTTP Command Arguments - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Scheduled Task Creation on Remote Endpoint using At - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Scheduled Task Initiation on Remote Endpoint - Rule", "ESCU - Schtasks scheduling job on remote system - Rule", "ESCU - Services LOLBAS Execution Process Spawn - Rule", "ESCU - Suspicious IcedID Rundll32 Cmdline - Rule", "ESCU - Suspicious microsoft workflow compiler rename - Rule", "ESCU - Suspicious microsoft workflow compiler usage - Rule", "ESCU - Suspicious msbuild path - Rule", "ESCU - Suspicious MSBuild Rename - Rule", "ESCU - Suspicious MSBuild Spawn - Rule", "ESCU - Suspicious mshta child process - Rule", "ESCU - Suspicious mshta spawn - Rule", "ESCU - Suspicious Regsvr32 Register Suspicious Path - Rule", "ESCU - Suspicious Rundll32 dllregisterserver - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Svchost LOLBAS Execution Process Spawn - Rule", "ESCU - Windows Diskshadow Proxy Execution - Rule", "ESCU - Windows InstallUtil in Non Standard Path - Rule", "ESCU - Windows InstallUtil Remote Network Connection - Rule", "ESCU - Windows InstallUtil Uninstall Option - Rule", "ESCU - Windows InstallUtil Uninstall Option with Network - Rule", "ESCU - Windows InstallUtil URL in Command Line - Rule", "ESCU - WSReset UAC Bypass - Rule"]
+description = Leverage analytics that allow you to identify the presence of an adversary leveraging native applications within your environment.
+narrative = Living Off The Land refers to an adversary methodology of using native applications already installed on the target operating system to achieve their objective. native utilities provide the adversary with reduced chances of detection by antivirus software or EDR tools. This allows the adversary to blend in with native process behavior.
 
 [analytic_story://Log4Shell CVE-2021-44228]
 category = Adversary Tactics
@@ -9422,7 +9422,7 @@ version = 5
 references = ["https://blogs.mcafee.com/mcafee-labs/malware-employs-powershell-to-infect-systems/", "https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}]
 spec_version = 3
-searches = ["ESCU - Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments - Rule", "ESCU - Any Powershell DownloadFile - Rule", "ESCU - Any Powershell DownloadString - Rule", "ESCU - Detect Empire with PowerShell Script Block Logging - Rule", "ESCU - Detect Mimikatz With PowerShell Script Block Logging - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Malicious PowerShell Process With Obfuscation Techniques - Rule", "ESCU - Possible Lateral Movement PowerShell Spawn - Rule", "ESCU - PowerShell 4104 Hunting - Rule", "ESCU - PowerShell - Connect To Internet With Hidden Window - Rule", "ESCU - Powershell Creating Thread Mutex - Rule", "ESCU - PowerShell Domain Enumeration - Rule", "ESCU - Powershell Enable SMB1Protocol Feature - Rule", "ESCU - Powershell Execute COM Object - Rule", "ESCU - Powershell Fileless Process Injection via GetProcAddress - Rule", "ESCU - Powershell Fileless Script Contains Base64 Encoded Content - Rule", "ESCU - PowerShell Loading DotNET into Memory via System Reflection Assembly - Rule", "ESCU - Powershell Processing Stream Of Data - Rule", "ESCU - Powershell Using memory As Backing Store - Rule", "ESCU - Recon AVProduct Through Pwh or WMI - Rule", "ESCU - Recon Using WMI Class - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unloading AMSI via Reflection - Rule", "ESCU - WMI Recon Running Process Or Services - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
+searches = ["ESCU - Suspicious Powershell Command-Line Arguments - Rule", "ESCU - Any Powershell DownloadFile - Rule", "ESCU - Any Powershell DownloadString - Rule", "ESCU - Detect Empire with PowerShell Script Block Logging - Rule", "ESCU - Detect Mimikatz With PowerShell Script Block Logging - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Malicious PowerShell Process With Obfuscation Techniques - Rule", "ESCU - Possible Lateral Movement PowerShell Spawn - Rule", "ESCU - PowerShell 4104 Hunting - Rule", "ESCU - PowerShell - Connect To Internet With Hidden Window - Rule", "ESCU - Powershell Creating Thread Mutex - Rule", "ESCU - PowerShell Domain Enumeration - Rule", "ESCU - Powershell Enable SMB1Protocol Feature - Rule", "ESCU - Powershell Execute COM Object - Rule", "ESCU - Powershell Fileless Process Injection via GetProcAddress - Rule", "ESCU - Powershell Fileless Script Contains Base64 Encoded Content - Rule", "ESCU - PowerShell Loading DotNET into Memory via Reflection - Rule", "ESCU - Powershell Processing Stream Of Data - Rule", "ESCU - Powershell Using memory As Backing Store - Rule", "ESCU - Recon AVProduct Through Pwh or WMI - Rule", "ESCU - Recon Using WMI Class - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unloading AMSI via Reflection - Rule", "ESCU - WMI Recon Running Process Or Services - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
 description = Attackers are finding stealthy ways "live off the land," leveraging utilities and tools that come standard on the endpoint--such as PowerShell--to achieve their goals without downloading binary files. These searches can help you detect and investigate PowerShell command-line options that may be indicative of malicious intent.
 narrative = The searches in this Analytic Story monitor for parameters often used for malicious purposes. It is helpful to understand how often the notable events generated by this story occur, as well as the commonalities between some of these events. These factors may provide clues about whether this is a common occurrence of minimal concern or a rare event that may require more extensive investigation. Likewise, it is important to determine whether the issue is restricted to a single user/system or is broader in scope. \
 The following factors may assist you in determining whether the event is malicious: \
@@ -9457,7 +9457,7 @@ version = 1
 references = ["https://www.offensive-security.com/metasploit-unleashed/about-meterpreter/", "https://doubleoctopus.com/security-wiki/threats-and-tools/meterpreter/", "https://www.rapid7.com/products/metasploit/"]
 maintainers = [{"company": "no", "email": "-", "name": "Michael Hart"}]
 spec_version = 3
-searches = ["ESCU - Excessive number of distinct processes created in Windows Temp folder - Rule", "ESCU - Excessive number of taskhost processes - Rule"]
+searches = ["ESCU - Excessive distinct processes from Windows Temp - Rule", "ESCU - Excessive number of taskhost processes - Rule"]
 description = Meterpreter provides red teams, pen testers and threat actors interactive access to a compromised host to run commands, upload payloads, download files, and other actions.
 narrative = This Analytic Story supports you to detect Tactics, Techniques and Procedures (TTPs) from Meterpreter. Meterpreter is a Metasploit payload for remote execution that leverages DLL injection to make it extremely difficult to detect.  Since the software runs in memory, no new processes are created upon injection.  It also leverages encrypted communication channels.\
 Meterpreter enables the operator to remotely run commands on the target machine, upload payloads, download files, dump password hashes, and much more.  It is difficult to determine from the forensic evidence what actions the operator performed.  Splunk Research, however, has observed anomalous behaviors on the compromised hosts that seem to only appear when Meterpreter is executing various commands.  With that, we have written new detections targeted to these detections.\
@@ -9630,7 +9630,7 @@ version = 1
 references = ["https://y4y.space/2021/08/12/my-steps-of-reproducing-proxyshell/", "https://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell", "https://www.youtube.com/watch?v=FC6iHw258RI", "https://www.huntress.com/blog/rapid-response-microsoft-exchange-servers-still-vulnerable-to-proxyshell-exploit#what-should-you-do", "https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-ProxyLogon-Is-Just-The-Tip-Of-The-Iceberg-A-New-Attack-Surface-On-Microsoft-Exchange-Server.pdf"]
 maintainers = [{"company": "Teoderick Contreras, Mauricio Velazco, Splunk", "email": "-", "name": "Michael Haag"}]
 spec_version = 3
-searches = ["ESCU - Detect Exchange Web Shell - Rule", "ESCU - W3WP Spawning Shell - Rule", "ESCU - Exchange PowerShell Abuse via SSRF - Rule", "ESCU - Exchange PowerShell Module Usage - Rule", "ESCU - Microsoft Exchange Mailbox Replication service writing Active Server Pages - Rule"]
+searches = ["ESCU - Detect Exchange Web Shell - Rule", "ESCU - W3WP Spawning Shell - Rule", "ESCU - Exchange PowerShell Abuse via SSRF - Rule", "ESCU - Exchange PowerShell Module Usage - Rule", "ESCU - MS Exchange Mailbox Replication service writing Active Server Pages - Rule"]
 description = ProxyShell is a chain of exploits targeting on-premise Microsoft Exchange Server - CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207.
 narrative = During Pwn2Own April 2021, a security researcher demonstrated an attack  chain targeting on-premise Microsoft Exchange Server. August 5th, the same researcher  publicly released further details and demonstrated the attack chain. CVE-2021-34473  Pre-auth path confusion leads to ACL Bypass (Patched in April by KB5001779)  CVE-2021-34523 - Elevation of privilege on Exchange PowerShell backend (Patched in April by KB5001779) . CVE-2021-31207 - Post-auth Arbitrary-File-Write  leads to RCE (Patched in May by KB5003435) Upon successful exploitation,  the remote attacker will have SYSTEM privileges on the Exchange Server. In addition    to remote access/execution, the adversary may be able to run Exchange PowerShell  Cmdlets to perform further actions.
 
@@ -9641,7 +9641,7 @@ version = 1
 references = ["https://www.carbonblack.com/2017/06/28/carbon-black-threat-research-technical-analysis-petya-notpetya-ransomware/", "https://www.splunk.com/blog/2017/06/27/closing-the-detection-to-mitigation-gap-or-to-petya-or-notpetya-whocares-.html"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}]
 spec_version = 3
-searches = ["ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - 7zip CommandLine To SMB Share Path - Rule", "ESCU - Allow File And Printing Sharing In Firewall - Rule", "ESCU - Allow Network Discovery In Firewall - Rule", "ESCU - Allow Operation with Consent Admin - Rule", "ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - Clear Unallocated Sector Using Cipher App - Rule", "ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Conti Common Exec parameter - Rule", "ESCU - Delete ShadowCopy With PowerShell - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect RClone Command-Line Usage - Rule", "ESCU - Detect Renamed RClone - Rule", "ESCU - Detect SharpHound Command-Line Arguments - Rule", "ESCU - Detect SharpHound File Modifications - Rule", "ESCU - Detect SharpHound Usage - Rule", "ESCU - Disable AMSI Through Registry - Rule", "ESCU - Disable ETW Through Registry - Rule", "ESCU - Disable Logs Using WevtUtil - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Excessive Service Stop Attempt - Rule", "ESCU - Excessive Usage Of Net App - Rule", "ESCU - Excessive Usage Of SC Service Utility - Rule", "ESCU - Execute Javascript With Jscript COM CLSID - Rule", "ESCU - Fsutil Zeroing File - Rule", "ESCU - ICACLS Grant Command - Rule", "ESCU - Known Services Killed by Ransomware - Rule", "ESCU - Modification Of Wallpaper - Rule", "ESCU - Msmpeng Application DLL Side Loading - Rule", "ESCU - Permission Modification using Takeown App - Rule", "ESCU - Powershell Disable Security Monitoring - Rule", "ESCU - Powershell Enable SMB1Protocol Feature - Rule", "ESCU - Powershell Execute COM Object - Rule", "ESCU - Prevent Automatic Repair Mode using Bcdedit - Rule", "ESCU - Recon AVProduct Through Pwh or WMI - Rule", "ESCU - Recursive Delete of Directory In Batch CMD - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Revil Common Exec Parameter - Rule", "ESCU - Revil Registry Entry - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Start Up During Safe Mode Boot - Rule", "ESCU - Suspicious Event Log Service Behavior - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - UAC Bypass With Colorui COM Object - Rule", "ESCU - Uninstall App Using MsiExec - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - Wbemprox COM Object Execution - Rule", "ESCU - Windows Disable Change Password Through Registry - Rule", "ESCU - Windows Disable Lock Workstation Feature Through Registry - Rule", "ESCU - Windows Disable LogOff Button Through Registry - Rule", "ESCU - Windows Disable Memory Crash Dump - Rule", "ESCU - Windows Disable Shutdown Button Through Registry - Rule", "ESCU - Windows Disable Windows Group Policy Features Through Registry - Rule", "ESCU - Windows DiskCryptor Usage - Rule", "ESCU - Windows DotNet Binary in Non Standard Path - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - Windows Hide Notification Features Through Registry - Rule", "ESCU - Windows InstallUtil in Non Standard Path - Rule", "ESCU - Windows NirSoft AdvancedRun - Rule", "ESCU - Windows Raccine Scheduled Task Deletion - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - Microsoft Exchange Mailbox Replication service writing Active Server Pages - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task", "ESCU - Rundll32 LockWorkStation - Response Task"]
+searches = ["ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - 7zip CommandLine To SMB Share Path - Rule", "ESCU - Allow File And Printing Sharing In Firewall - Rule", "ESCU - Allow Network Discovery In Firewall - Rule", "ESCU - Allow Operation with Consent Admin - Rule", "ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - Clear Unallocated Sector Using Cipher App - Rule", "ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Conti Common Exec parameter - Rule", "ESCU - Delete ShadowCopy With PowerShell - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect RClone Command-Line Usage - Rule", "ESCU - Detect Renamed RClone - Rule", "ESCU - Detect SharpHound Command-Line Arguments - Rule", "ESCU - Detect SharpHound File Modifications - Rule", "ESCU - Detect SharpHound Usage - Rule", "ESCU - Disable AMSI Through Registry - Rule", "ESCU - Disable ETW Through Registry - Rule", "ESCU - Disable Logs Using WevtUtil - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Excessive Service Stop Attempt - Rule", "ESCU - Excessive Usage Of Net App - Rule", "ESCU - Excessive Usage Of SC Service Utility - Rule", "ESCU - Execute Javascript With Jscript COM CLSID - Rule", "ESCU - Fsutil Zeroing File - Rule", "ESCU - ICACLS Grant Command - Rule", "ESCU - Known Services Killed by Ransomware - Rule", "ESCU - Modification Of Wallpaper - Rule", "ESCU - Msmpeng Application DLL Side Loading - Rule", "ESCU - Permission Modification using Takeown App - Rule", "ESCU - Powershell Disable Security Monitoring - Rule", "ESCU - Powershell Enable SMB1Protocol Feature - Rule", "ESCU - Powershell Execute COM Object - Rule", "ESCU - Prevent Automatic Repair Mode using Bcdedit - Rule", "ESCU - Recon AVProduct Through Pwh or WMI - Rule", "ESCU - Recursive Delete of Directory In Batch CMD - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Revil Common Exec Parameter - Rule", "ESCU - Revil Registry Entry - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Start Up During Safe Mode Boot - Rule", "ESCU - Suspicious Event Log Service Behavior - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - UAC Bypass With Colorui COM Object - Rule", "ESCU - Uninstall App Using MsiExec - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - Wbemprox COM Object Execution - Rule", "ESCU - Windows Disable Change Password Through Registry - Rule", "ESCU - Windows Disable Lock Workstation Feature Through Registry - Rule", "ESCU - Windows Disable LogOff Button Through Registry - Rule", "ESCU - Windows Disable Memory Crash Dump - Rule", "ESCU - Windows Disable Shutdown Button Through Registry - Rule", "ESCU - Windows Disable Windows Group Policy Features Through Registry - Rule", "ESCU - Windows DiskCryptor Usage - Rule", "ESCU - Windows DotNet Binary in Non Standard Path - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - Windows Hide Notification Features Through Registry - Rule", "ESCU - Windows InstallUtil in Non Standard Path - Rule", "ESCU - Windows NirSoft AdvancedRun - Rule", "ESCU - Windows Raccine Scheduled Task Deletion - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - MS Exchange Mailbox Replication service writing Active Server Pages - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task", "ESCU - Rundll32 LockWorkStation - Response Task"]
 description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware--spikes in SMB traffic, suspicious wevtutil usage, the presence of common ransomware extensions, and system processes run from unexpected locations, and many others.
 narrative = Ransomware is an ever-present risk to the enterprise, wherein an infected host encrypts business-critical data, holding it hostage until the victim pays the attacker a ransom. There are many types and varieties of ransomware that can affect an enterprise. Attackers can deploy ransomware to enterprises through spearphishing campaigns and driveby downloads, as well as through traditional remote service-based exploitation. In the case of the WannaCry campaign, there was self-propagating wormable functionality that was used to maximize infection. Fortunately, organizations can apply several techniques--such as those in this Analytic Story--to detect and or mitigate the effects of ransomware.
 

dist/escu/default/collections.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-15T15:18:01 UTC
+# On Date: 2022-03-21T07:44:43 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/data/ui/panels/workbench_panel_all_backup_logs_for_host___response_task.xml

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-15T15:18:02 UTC
+# On Date: 2022-03-21T07:44:44 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/data/ui/panels/workbench_panel_amazon_eks_kubernetes_activity_by_src_ip___response_task.xml

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-15T15:18:02 UTC
+# On Date: 2022-03-21T07:44:44 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/data/ui/panels/workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task.xml

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-15T15:18:02 UTC
+# On Date: 2022-03-21T07:44:44 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/data/ui/panels/workbench_panel_aws_investigate_user_activities_by_accesskeyid___response_task.xml

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-15T15:18:02 UTC
+# On Date: 2022-03-21T07:44:44 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/data/ui/panels/workbench_panel_aws_investigate_user_activities_by_arn___response_task.xml

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-15T15:18:02 UTC
+# On Date: 2022-03-21T07:44:44 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/data/ui/panels/workbench_panel_aws_network_acl_details_from_id___response_task.xml

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-15T15:18:02 UTC
+# On Date: 2022-03-21T07:44:44 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/data/ui/panels/workbench_panel_aws_network_interface_details_via_resourceid___response_task.xml

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-15T15:18:02 UTC
+# On Date: 2022-03-21T07:44:44 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/data/ui/panels/workbench_panel_aws_s3_bucket_details_via_bucketname___response_task.xml

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-15T15:18:02 UTC
+# On Date: 2022-03-21T07:44:44 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/data/ui/panels/workbench_panel_gcp_kubernetes_activity_by_src_ip___response_task.xml

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-15T15:18:02 UTC
+# On Date: 2022-03-21T07:44:44 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_city___response_task.xml

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-15T15:18:02 UTC
+# On Date: 2022-03-21T07:44:44 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_country___response_task.xml

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-15T15:18:02 UTC
+# On Date: 2022-03-21T07:44:44 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_ip_address___response_task.xml

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-15T15:18:02 UTC
+# On Date: 2022-03-21T07:44:44 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_region___response_task.xml

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-15T15:18:02 UTC
+# On Date: 2022-03-21T07:44:44 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/data/ui/panels/workbench_panel_get_backup_logs_for_endpoint___response_task.xml

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-15T15:18:02 UTC
+# On Date: 2022-03-21T07:44:44 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/data/ui/panels/workbench_panel_get_certificate_logs_for_a_domain___response_task.xml

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-15T15:18:02 UTC
+# On Date: 2022-03-21T07:44:44 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/data/ui/panels/workbench_panel_get_dns_server_history_for_a_host___response_task.xml

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-15T15:18:02 UTC
+# On Date: 2022-03-21T07:44:44 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/data/ui/panels/workbench_panel_get_dns_traffic_ratio___response_task.xml

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-15T15:18:02 UTC
+# On Date: 2022-03-21T07:44:44 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/data/ui/panels/workbench_panel_get_ec2_instance_details_by_instanceid___response_task.xml

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-15T15:18:02 UTC
+# On Date: 2022-03-21T07:44:44 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/data/ui/panels/workbench_panel_get_ec2_launch_details___response_task.xml

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-15T15:18:02 UTC
+# On Date: 2022-03-21T07:44:44 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/data/ui/panels/workbench_panel_get_email_info___response_task.xml

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-15T15:18:02 UTC
+# On Date: 2022-03-21T07:44:44 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/data/ui/panels/workbench_panel_get_emails_from_specific_sender___response_task.xml

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-15T15:18:02 UTC
+# On Date: 2022-03-21T07:44:44 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/data/ui/panels/workbench_panel_get_first_occurrence_and_last_occurrence_of_a_mac_address___response_task.xml

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-15T15:18:02 UTC
+# On Date: 2022-03-21T07:44:44 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/data/ui/panels/workbench_panel_get_history_of_email_sources___response_task.xml

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-15T15:18:02 UTC
+# On Date: 2022-03-21T07:44:44 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/data/ui/panels/workbench_panel_get_logon_rights_modifications_for_endpoint___response_task.xml

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-15T15:18:02 UTC
+# On Date: 2022-03-21T07:44:44 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/data/ui/panels/workbench_panel_get_logon_rights_modifications_for_user___response_task.xml

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-15T15:18:02 UTC
+# On Date: 2022-03-21T07:44:44 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/data/ui/panels/workbench_panel_get_notable_history___response_task.xml

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-15T15:18:02 UTC
+# On Date: 2022-03-21T07:44:44 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/data/ui/panels/workbench_panel_get_parent_process_info___response_task.xml

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-15T15:18:02 UTC
+# On Date: 2022-03-21T07:44:44 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/data/ui/panels/workbench_panel_get_process_file_activity___response_task.xml

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-15T15:18:02 UTC
+# On Date: 2022-03-21T07:44:44 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/data/ui/panels/workbench_panel_get_process_info___response_task.xml

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-15T15:18:02 UTC
+# On Date: 2022-03-21T07:44:44 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/data/ui/panels/workbench_panel_get_process_information_for_port_activity___response_task.xml

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-15T15:18:02 UTC
+# On Date: 2022-03-21T07:44:44 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/data/ui/panels/workbench_panel_get_process_responsible_for_the_dns_traffic___response_task.xml

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-15T15:18:02 UTC
+# On Date: 2022-03-21T07:44:44 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/data/ui/panels/workbench_panel_get_sysmon_wmi_activity_for_host___response_task.xml

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-15T15:18:02 UTC
+# On Date: 2022-03-21T07:44:44 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/data/ui/panels/workbench_panel_get_web_session_information_via_session_id___response_task.xml

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-15T15:18:02 UTC
+# On Date: 2022-03-21T07:44:44 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/data/ui/panels/workbench_panel_investigate_aws_activities_via_region_name___response_task.xml

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-15T15:18:02 UTC
+# On Date: 2022-03-21T07:44:44 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/data/ui/panels/workbench_panel_investigate_aws_user_activities_by_user_field___response_task.xml

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-15T15:18:02 UTC
+# On Date: 2022-03-21T07:44:44 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/data/ui/panels/workbench_panel_investigate_failed_logins_for_multiple_destinations___response_task.xml

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-15T15:18:02 UTC
+# On Date: 2022-03-21T07:44:44 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/data/ui/panels/workbench_panel_investigate_network_traffic_from_src_ip___response_task.xml

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-15T15:18:02 UTC
+# On Date: 2022-03-21T07:44:44 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/data/ui/panels/workbench_panel_investigate_okta_activity_by_app___response_task.xml

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-15T15:18:02 UTC
+# On Date: 2022-03-21T07:44:44 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/data/ui/panels/workbench_panel_investigate_pass_the_hash_attempts___response_task.xml

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-15T15:18:02 UTC
+# On Date: 2022-03-21T07:44:44 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/data/ui/panels/workbench_panel_investigate_pass_the_ticket_attempts___response_task.xml

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-15T15:18:02 UTC
+# On Date: 2022-03-21T07:44:44 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/data/ui/panels/workbench_panel_investigate_previous_unseen_user___response_task.xml

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-15T15:18:02 UTC
+# On Date: 2022-03-21T07:44:44 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/data/ui/panels/workbench_panel_investigate_successful_remote_desktop_authentications___response_task.xml

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-15T15:18:02 UTC
+# On Date: 2022-03-21T07:44:44 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/data/ui/panels/workbench_panel_investigate_suspicious_strings_in_http_header___response_task.xml

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-15T15:18:02 UTC
+# On Date: 2022-03-21T07:44:44 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/data/ui/panels/workbench_panel_investigate_user_activities_in_okta___response_task.xml

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-15T15:18:02 UTC
+# On Date: 2022-03-21T07:44:44 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/data/ui/panels/workbench_panel_investigate_web_posts_from_src___response_task.xml

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-15T15:18:02 UTC
+# On Date: 2022-03-21T07:44:44 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/es_investigations.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-15T15:18:01 UTC
+# On Date: 2022-03-21T07:44:43 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/macros.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-15T15:18:01 UTC
+# On Date: 2022-03-21T07:44:43 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -473,7 +473,7 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
-[kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace_filter]
+[kubernetes_azure_active_service_accounts_by_pod_namespace_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
@@ -529,10 +529,6 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
-[malicious_powershell_process___multiple_suspicious_command_line_arguments_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
 [monitor_dns_for_brand_abuse_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -585,6 +581,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[suspicious_powershell_command_line_arguments_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [suspicious_rundll32_rename_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -1265,11 +1265,11 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
-[excessive_file_deletion_in_windefender_folder_filter]
+[excessive_distinct_processes_from_windows_temp_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
-[excessive_number_of_distinct_processes_created_in_windows_temp_folder_filter]
+[excessive_file_deletion_in_windefender_folder_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
@@ -1809,22 +1809,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
-[multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
-[multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
 [multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
-[multiple_users_attempting_to_authenticate_using_explicit_credentials_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
 [multiple_users_failing_to_authenticate_from_host_using_kerberos_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -2025,7 +2013,7 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
-[powershell_loading_dotnet_into_memory_via_system_reflection_assembly_filter]
+[powershell_loading_dotnet_into_memory_via_reflection_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
@@ -2693,6 +2681,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_disabled_users_failing_to_authenticate_kerberos_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_diskcryptor_usage_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -2761,6 +2753,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_invalid_users_failed_authentication_via_kerberos_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_modify_show_compress_color_and_info_tip_registry_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -2833,6 +2829,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_users_authenticate_using_explicit_credentials_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_wmi_process_call_create_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -3101,7 +3101,7 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
-[microsoft_exchange_mailbox_replication_service_writing_active_server_pages_filter]
+[ms_exchange_mailbox_replication_service_writing_active_server_pages_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 

dist/escu/default/transforms.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-15T15:18:01 UTC
+# On Date: 2022-03-21T07:44:43 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/workflow_actions.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-03-15T15:18:01 UTC
+# On Date: 2022-03-21T07:44:43 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############