diff --git a/data_sources/endpoint/Sysmon_Event_ID_1.yml b/data_sources/endpoint/Sysmon_Event_ID_1.yml
index 2069df6cb2..65d9b2716a 100644
--- a/data_sources/endpoint/Sysmon_Event_ID_1.yml
+++ b/data_sources/endpoint/Sysmon_Event_ID_1.yml
@@ -53,10 +53,12 @@ convert_to_log_source:
     mapping:
       ProcessId: NewProcessId 
       Image: NewProcessName
+      Image|endswith: NewProcessName|endswith
       CommandLine: Process_Command_Line
       User: SubjectUserSid
       ParentProcessId: ProcessId
       ParentImage: ParentProcessName
+      ParentImage|endswith: ParentProcessName|endswith
       Computer: Computer
   - data_source: Crowdstrike Process
     mapping:
diff --git a/data_sources/endpoint/Windows_Security_4688.yml b/data_sources/endpoint/Windows_Security_4688.yml
index b66809f218..557bd68733 100644
--- a/data_sources/endpoint/Windows_Security_4688.yml
+++ b/data_sources/endpoint/Windows_Security_4688.yml
@@ -30,20 +30,24 @@ field_mappings:
     data_set: Endpoint.Processes
     mapping:
       NewProcessId: Processes.process_id
-      NewProcessName: Processes.process_name
+      NewProcessName: Processes.process_path
+      NewProcessName|endswith: Processes.process_name
       Process_Command_Line: Processes.process
       SubjectUserSid: Processes.user
       ProcessId: Processes.parent_process_id
-      ParentProcessName: Processes.parent_process_name
+      ParentProcessName: Processes.parent_process_path
+      ParentProcessName|endswith: Processes.parent_process_name
       Computer: Processes.dest
   - data_model: ocsf
     mapping:
       NewProcessId: process.pid
-      NewProcessName: process.file.name
+      NewProcessName: process.file.path
+      NewProcessName|endswith: process.file.name
       Process_Command_Line: process.cmd_line
       SubjectUserSid: process.user.name
       ProcessId: actor.process.pid
-      ParentProcessName: actor.process.file.name
+      ParentProcessName: actor.process.file.path
+      ParentProcessName|endswith: actor.process.file.name
       Computer: device.hostname
 convert_to_log_source:
   - data_source: Sysmon Event ID 1
diff --git a/ssa_detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml b/ssa_detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml
index 5783efb8e6..84358e8233 100644
--- a/ssa_detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml
+++ b/ssa_detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml
@@ -14,19 +14,21 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
   process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
   "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
-  any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
-  null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
-  | eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
-  process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
-  "map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
-  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
-  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
-  any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
-  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
-  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where (process_file_name="WinRAR.exe" OR like(process_file_name, "7z%")
-  OR like(process_file_name, "winzip%")) AND (like(actor_process_file_name, "%powershell.exe")
-  OR like(actor_process_file_name, "%cmd.exe")) --finding_report--'
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
+  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
+  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
+  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
+  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
+  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
+  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
+  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
+  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
+  (process_file_name="WinRAR.exe" OR like(process_file_name, "7z%") OR like(process_file_name,
+  "winzip%")) AND (like(actor_process_file_name, "%powershell.exe") OR like(actor_process_file_name,
+  "%cmd.exe")) --finding_report--'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node.
@@ -72,6 +74,8 @@ tags:
   mappings:
   - ocsf: process.pid
     cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
   - ocsf: process.file.name
     cim: process_name
   - ocsf: process.cmd_line
@@ -80,6 +84,8 @@ tags:
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
   - ocsf: actor.process.file.name
     cim: parent_process_name
   - ocsf: device.hostname
diff --git a/ssa_detections/endpoint/ssa___attempt_to_delete_services.yml b/ssa_detections/endpoint/ssa___attempt_to_delete_services.yml
index a38c32e235..46593a6ac6 100644
--- a/ssa_detections/endpoint/ssa___attempt_to_delete_services.yml
+++ b/ssa_detections/endpoint/ssa___attempt_to_delete_services.yml
@@ -17,18 +17,19 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
   process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
   "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
-  any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
-  null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
-  | eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
-  process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
-  "map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
-  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
-  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
-  any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
-  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
-  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where process_file_name="sc.exe" AND like(process_cmd_line, "%delete%")
-  --finding_report--'
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
+  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
+  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
+  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
+  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
+  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
+  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
+  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
+  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
+  process_file_name="sc.exe" AND like(process_cmd_line, "%delete%") --finding_report--'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -72,6 +73,8 @@ tags:
   mappings:
   - ocsf: process.pid
     cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
   - ocsf: process.file.name
     cim: process_name
   - ocsf: process.cmd_line
@@ -80,6 +83,8 @@ tags:
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
   - ocsf: actor.process.file.name
     cim: parent_process_name
   - ocsf: device.hostname
diff --git a/ssa_detections/endpoint/ssa___attempt_to_disable_services.yml b/ssa_detections/endpoint/ssa___attempt_to_disable_services.yml
index 0861149c6a..7038a03b40 100644
--- a/ssa_detections/endpoint/ssa___attempt_to_disable_services.yml
+++ b/ssa_detections/endpoint/ssa___attempt_to_disable_services.yml
@@ -17,18 +17,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
   process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
   "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
-  any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
-  null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
-  | eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
-  process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
-  "map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
-  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
-  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
-  any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
-  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
-  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where like(process_cmd_line, "%config%") AND like(process_cmd_line, "%disabled%")
-  AND process_file_name="sc.exe" --finding_report--'
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
+  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
+  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
+  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
+  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
+  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
+  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
+  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
+  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
+  like(process_cmd_line, "%config%") AND like(process_cmd_line, "%disabled%") AND
+  process_file_name="sc.exe" --finding_report--'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -71,6 +73,8 @@ tags:
   mappings:
   - ocsf: process.pid
     cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
   - ocsf: process.file.name
     cim: process_name
   - ocsf: process.cmd_line
@@ -79,6 +83,8 @@ tags:
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
   - ocsf: actor.process.file.name
     cim: parent_process_name
   - ocsf: device.hostname
diff --git a/ssa_detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml b/ssa_detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml
index 7c7a7a09de..9bd3616529 100644
--- a/ssa_detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml
+++ b/ssa_detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml
@@ -15,17 +15,19 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
   process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
   "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
-  any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
-  null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
-  | eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
-  process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
-  "map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
-  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
-  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
-  any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
-  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
-  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where (process_file_name="reg.exe" OR process_file_name="cmd.exe") AND (match_regex(process_cmd_line,
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
+  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
+  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
+  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
+  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
+  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
+  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
+  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
+  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
+  (process_file_name="reg.exe" OR process_file_name="cmd.exe") AND (match_regex(process_cmd_line,
   /(?i)HKEY_LOCAL_MACHINE\\System/)=true OR match_regex(process_cmd_line, /(?i)HKEY_LOCAL_MACHINE\\SAM/)=true
   OR match_regex(process_cmd_line, /(?i)HKEY_LOCAL_MACHINE\\Security/)=true OR match_regex(process_cmd_line,
   /(?i)HKLM\\System/)=true OR match_regex(process_cmd_line, /(?i)HKLM\\SAM/)=true
@@ -71,6 +73,8 @@ tags:
   mappings:
   - ocsf: process.pid
     cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
   - ocsf: process.file.name
     cim: process_name
   - ocsf: process.cmd_line
@@ -79,6 +83,8 @@ tags:
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
   - ocsf: actor.process.file.name
     cim: parent_process_name
   - ocsf: device.hostname
diff --git a/ssa_detections/endpoint/ssa___bcdedit_failure_recovery_modification.yml b/ssa_detections/endpoint/ssa___bcdedit_failure_recovery_modification.yml
index 7b15750373..0fc1efabcd 100644
--- a/ssa_detections/endpoint/ssa___bcdedit_failure_recovery_modification.yml
+++ b/ssa_detections/endpoint/ssa___bcdedit_failure_recovery_modification.yml
@@ -15,18 +15,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
   process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
   "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
-  any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
-  null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
-  | eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
-  process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
-  "map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
-  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
-  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
-  any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
-  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
-  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where process_file_name="bcdedit.exe" AND (like(process_cmd_line, "%no%")
-  AND like(process_cmd_line, "%recoveryenabled%")) --finding_report--'
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
+  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
+  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
+  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
+  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
+  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
+  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
+  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
+  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
+  process_file_name="bcdedit.exe" AND (like(process_cmd_line, "%no%") AND like(process_cmd_line,
+  "%recoveryenabled%")) --finding_report--'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint_Processess` datamodel.
@@ -67,6 +69,8 @@ tags:
   mappings:
   - ocsf: process.pid
     cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
   - ocsf: process.file.name
     cim: process_name
   - ocsf: process.cmd_line
@@ -75,6 +79,8 @@ tags:
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
   - ocsf: actor.process.file.name
     cim: parent_process_name
   - ocsf: device.hostname
diff --git a/ssa_detections/endpoint/ssa___clear_unallocated_sector_using_cipher_app.yml b/ssa_detections/endpoint/ssa___clear_unallocated_sector_using_cipher_app.yml
index 37c0209a92..01232bc199 100644
--- a/ssa_detections/endpoint/ssa___clear_unallocated_sector_using_cipher_app.yml
+++ b/ssa_detections/endpoint/ssa___clear_unallocated_sector_using_cipher_app.yml
@@ -15,18 +15,19 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
   process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
   "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
-  any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
-  null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
-  | eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
-  process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
-  "map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
-  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
-  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
-  any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
-  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
-  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where process_file_name="cipher.exe" AND like(process_cmd_line, "%/W:%")
-  --finding_report--'
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
+  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
+  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
+  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
+  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
+  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
+  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
+  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
+  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
+  process_file_name="cipher.exe" AND like(process_cmd_line, "%/W:%") --finding_report--'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node.
@@ -68,6 +69,8 @@ tags:
   mappings:
   - ocsf: process.pid
     cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
   - ocsf: process.file.name
     cim: process_name
   - ocsf: process.cmd_line
@@ -76,6 +79,8 @@ tags:
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
   - ocsf: actor.process.file.name
     cim: parent_process_name
   - ocsf: device.hostname
diff --git a/ssa_detections/endpoint/ssa___delete_a_net_user.yml b/ssa_detections/endpoint/ssa___delete_a_net_user.yml
index 7631b8eed2..7800ccd9d3 100644
--- a/ssa_detections/endpoint/ssa___delete_a_net_user.yml
+++ b/ssa_detections/endpoint/ssa___delete_a_net_user.yml
@@ -18,18 +18,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
   process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
   "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
-  any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
-  null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
-  | eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
-  process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
-  "map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
-  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
-  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
-  any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
-  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
-  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where like(process_cmd_line, "%user%") AND like(process_cmd_line, "%/delete%")
-  AND (process_file_name="net.exe" OR process_file_name="net1.exe") --finding_report--'
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
+  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
+  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
+  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
+  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
+  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
+  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
+  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
+  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
+  like(process_cmd_line, "%user%") AND like(process_cmd_line, "%/delete%") AND (process_file_name="net.exe"
+  OR process_file_name="net1.exe") --finding_report--'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -71,6 +73,8 @@ tags:
   mappings:
   - ocsf: process.pid
     cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
   - ocsf: process.file.name
     cim: process_name
   - ocsf: process.cmd_line
@@ -79,6 +83,8 @@ tags:
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
   - ocsf: actor.process.file.name
     cim: parent_process_name
   - ocsf: device.hostname
diff --git a/ssa_detections/endpoint/ssa___deny_permission_using_cacls_utility.yml b/ssa_detections/endpoint/ssa___deny_permission_using_cacls_utility.yml
index 839e77582f..86cf46b5f7 100644
--- a/ssa_detections/endpoint/ssa___deny_permission_using_cacls_utility.yml
+++ b/ssa_detections/endpoint/ssa___deny_permission_using_cacls_utility.yml
@@ -16,19 +16,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
   process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
   "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
-  any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
-  null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
-  | eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
-  process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
-  "map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
-  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
-  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
-  any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
-  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
-  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where (process_file_name="icacls.exe" OR process_file_name="xcacls.exe"
-  OR process_file_name="cacls.exe") AND match_regex(process_cmd_line, /(?i)deny/)=true
-  --finding_report--'
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
+  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
+  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
+  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
+  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
+  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
+  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
+  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
+  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
+  (process_file_name="icacls.exe" OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe")
+  AND match_regex(process_cmd_line, /(?i)deny/)=true --finding_report--'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -69,6 +70,8 @@ tags:
   mappings:
   - ocsf: process.pid
     cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
   - ocsf: process.file.name
     cim: process_name
   - ocsf: process.cmd_line
@@ -77,6 +80,8 @@ tags:
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
   - ocsf: actor.process.file.name
     cim: parent_process_name
   - ocsf: device.hostname
diff --git a/ssa_detections/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.yml b/ssa_detections/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.yml
index 71ac970af5..c93f2a3592 100644
--- a/ssa_detections/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.yml
+++ b/ssa_detections/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.yml
@@ -16,19 +16,21 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
   process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
   "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
-  any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
-  null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
-  | eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
-  process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
-  "map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
-  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
-  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
-  any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
-  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
-  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where (actor_process_file_name="winword.exe" OR actor_process_file_name="excel.exe"
-  OR actor_process_file_name="outlook.exe" OR actor_process_file_name="acrobat.exe"
-  OR actor_process_file_name="acrord32.exe" OR actor_process_file_name="iexplore.exe"
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
+  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
+  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
+  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
+  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
+  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
+  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
+  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
+  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
+  (actor_process_file_name="winword.exe" OR actor_process_file_name="excel.exe" OR
+  actor_process_file_name="outlook.exe" OR actor_process_file_name="acrobat.exe" OR
+  actor_process_file_name="acrord32.exe" OR actor_process_file_name="iexplore.exe"
   OR actor_process_file_name="opera.exe" OR actor_process_file_name="firefox.exe"
   OR actor_process_file_name="powershell.exe" OR actor_process_file_name IS NOT NULL)
   OR (actor_process_file_name="java.exe" AND (NOT match_regex(parent_process, /(?i)patch1-Hotfix1a/)=true))
@@ -71,6 +73,8 @@ tags:
   mappings:
   - ocsf: process.pid
     cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
   - ocsf: process.file.name
     cim: process_name
   - ocsf: process.cmd_line
@@ -79,6 +83,8 @@ tags:
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
   - ocsf: actor.process.file.name
     cim: parent_process_name
   - ocsf: device.hostname
diff --git a/ssa_detections/endpoint/ssa___detect_rclone_command_line_usage.yml b/ssa_detections/endpoint/ssa___detect_rclone_command_line_usage.yml
index a3ff7c4ba0..b65f9570c5 100644
--- a/ssa_detections/endpoint/ssa___detect_rclone_command_line_usage.yml
+++ b/ssa_detections/endpoint/ssa___detect_rclone_command_line_usage.yml
@@ -19,23 +19,24 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
   process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
   "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
-  any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
-  null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
-  | eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
-  process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
-  "map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
-  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
-  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
-  any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
-  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
-  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where (like(process_cmd_line, "%--multi-thread-streams%") OR like(process_cmd_line,
-  "%--transfers%") OR like(process_cmd_line, "%--auto-confirm%") OR like(process_cmd_line,
-  "%--ignore-existing%") OR like(process_cmd_line, "%--no-check-certificate%") OR
-  like(process_cmd_line, "%--progress%") OR like(process_cmd_line, "%--config%") OR
-  like(process_cmd_line, "%ftp%") OR like(process_cmd_line, "%pcloud%") OR like(process_cmd_line,
-  "%mega%") OR like(process_cmd_line, "%copy%")) AND process_file_name="rclone.exe"
-  --finding_report--'
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
+  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
+  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
+  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
+  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
+  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
+  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
+  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
+  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
+  (like(process_cmd_line, "%--multi-thread-streams%") OR like(process_cmd_line, "%--transfers%")
+  OR like(process_cmd_line, "%--auto-confirm%") OR like(process_cmd_line, "%--ignore-existing%")
+  OR like(process_cmd_line, "%--no-check-certificate%") OR like(process_cmd_line,
+  "%--progress%") OR like(process_cmd_line, "%--config%") OR like(process_cmd_line,
+  "%ftp%") OR like(process_cmd_line, "%pcloud%") OR like(process_cmd_line, "%mega%")
+  OR like(process_cmd_line, "%copy%")) AND process_file_name="rclone.exe" --finding_report--'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint_Processess` datamodel.
@@ -80,6 +81,8 @@ tags:
   mappings:
   - ocsf: process.pid
     cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
   - ocsf: process.file.name
     cim: process_name
   - ocsf: process.cmd_line
@@ -88,6 +91,8 @@ tags:
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
   - ocsf: actor.process.file.name
     cim: parent_process_name
   - ocsf: device.hostname
diff --git a/ssa_detections/endpoint/ssa___disable_net_user_account.yml b/ssa_detections/endpoint/ssa___disable_net_user_account.yml
index 132dae39c2..49d6db7a3d 100644
--- a/ssa_detections/endpoint/ssa___disable_net_user_account.yml
+++ b/ssa_detections/endpoint/ssa___disable_net_user_account.yml
@@ -16,18 +16,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
   process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
   "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
-  any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
-  null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
-  | eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
-  process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
-  "map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
-  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
-  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
-  any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
-  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
-  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where like(process_cmd_line, "%user%") AND like(process_cmd_line, "%/active:no%")
-  AND (process_file_name="net.exe" OR process_file_name="net1.exe") --finding_report--'
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
+  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
+  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
+  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
+  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
+  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
+  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
+  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
+  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
+  like(process_cmd_line, "%user%") AND like(process_cmd_line, "%/active:no%") AND
+  (process_file_name="net.exe" OR process_file_name="net1.exe") --finding_report--'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -70,6 +72,8 @@ tags:
   mappings:
   - ocsf: process.pid
     cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
   - ocsf: process.file.name
     cim: process_name
   - ocsf: process.cmd_line
@@ -78,6 +82,8 @@ tags:
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
   - ocsf: actor.process.file.name
     cim: parent_process_name
   - ocsf: device.hostname
diff --git a/ssa_detections/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml b/ssa_detections/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml
index 5f1327901a..ba04d42c8a 100644
--- a/ssa_detections/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml
+++ b/ssa_detections/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml
@@ -18,19 +18,21 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
   process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
   "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
-  any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
-  null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
-  | eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
-  process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
-  "map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
-  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
-  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
-  any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
-  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
-  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where (like(process_cmd_line, "%-retry=%") OR like(process_cmd_line, "%-type=%")
-  OR like(process_cmd_line, "%-q=%") OR like(process_cmd_line, "%-qt=%") OR like(process_cmd_line,
-  "%-querytype=%")) AND process_file_name="nslookup.exe" --finding_report--'
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
+  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
+  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
+  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
+  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
+  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
+  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
+  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
+  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
+  (like(process_cmd_line, "%-retry=%") OR like(process_cmd_line, "%-type=%") OR like(process_cmd_line,
+  "%-q=%") OR like(process_cmd_line, "%-qt=%") OR like(process_cmd_line, "%-querytype=%"))
+  AND process_file_name="nslookup.exe" --finding_report--'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint_Processess` datamodel.
@@ -75,6 +77,8 @@ tags:
   mappings:
   - ocsf: process.pid
     cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
   - ocsf: process.file.name
     cim: process_name
   - ocsf: process.cmd_line
@@ -83,6 +87,8 @@ tags:
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
   - ocsf: actor.process.file.name
     cim: parent_process_name
   - ocsf: device.hostname
diff --git a/ssa_detections/endpoint/ssa___fsutil_zeroing_file.yml b/ssa_detections/endpoint/ssa___fsutil_zeroing_file.yml
index 65bd1a8e58..561edd8183 100644
--- a/ssa_detections/endpoint/ssa___fsutil_zeroing_file.yml
+++ b/ssa_detections/endpoint/ssa___fsutil_zeroing_file.yml
@@ -15,18 +15,19 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
   process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
   "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
-  any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
-  null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
-  | eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
-  process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
-  "map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
-  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
-  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
-  any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
-  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
-  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where like(process_cmd_line, "%setzerodata%") AND process_file_name="fsutil.exe"
-  --finding_report--'
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
+  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
+  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
+  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
+  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
+  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
+  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
+  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
+  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
+  like(process_cmd_line, "%setzerodata%") AND process_file_name="fsutil.exe" --finding_report--'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -70,6 +71,8 @@ tags:
   mappings:
   - ocsf: process.pid
     cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
   - ocsf: process.file.name
     cim: process_name
   - ocsf: process.cmd_line
@@ -78,6 +81,8 @@ tags:
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
   - ocsf: actor.process.file.name
     cim: parent_process_name
   - ocsf: device.hostname
diff --git a/ssa_detections/endpoint/ssa___grant_permission_using_cacls_utility.yml b/ssa_detections/endpoint/ssa___grant_permission_using_cacls_utility.yml
index 13baae6ddd..a044ce6a39 100644
--- a/ssa_detections/endpoint/ssa___grant_permission_using_cacls_utility.yml
+++ b/ssa_detections/endpoint/ssa___grant_permission_using_cacls_utility.yml
@@ -16,19 +16,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
   process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
   "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
-  any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
-  null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
-  | eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
-  process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
-  "map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
-  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
-  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
-  any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
-  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
-  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where (process_file_name="icacls.exe" OR process_file_name="xcacls.exe"
-  OR process_file_name="cacls.exe") AND match_regex(process_cmd_line, /(?i)grant/)=true
-  --finding_report--'
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
+  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
+  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
+  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
+  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
+  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
+  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
+  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
+  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
+  (process_file_name="icacls.exe" OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe")
+  AND match_regex(process_cmd_line, /(?i)grant/)=true --finding_report--'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -69,6 +70,8 @@ tags:
   mappings:
   - ocsf: process.pid
     cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
   - ocsf: process.file.name
     cim: process_name
   - ocsf: process.cmd_line
@@ -77,6 +80,8 @@ tags:
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
   - ocsf: actor.process.file.name
     cim: parent_process_name
   - ocsf: device.hostname
diff --git a/ssa_detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml b/ssa_detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml
index 9c2f1efa2d..75e7b334b1 100644
--- a/ssa_detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml
+++ b/ssa_detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml
@@ -16,18 +16,19 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
   process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
   "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
-  any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
-  null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
-  | eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
-  process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
-  "map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
-  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
-  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
-  any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
-  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
-  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where process_file_name="attrib.exe" AND match_regex(process_cmd_line, /(?i)/)=true
-  --finding_report--'
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
+  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
+  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
+  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
+  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
+  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
+  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
+  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
+  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
+  process_file_name="attrib.exe" AND match_regex(process_cmd_line, /(?i)/)=true --finding_report--'
 how_to_implement: You must be ingesting data that records process activity from your
   hosts to populate the Endpoint data model in the Processes node. You must also be
   ingesting logs with both the process name and command line from your endpoints.
@@ -71,6 +72,8 @@ tags:
   mappings:
   - ocsf: process.pid
     cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
   - ocsf: process.file.name
     cim: process_name
   - ocsf: process.cmd_line
@@ -79,6 +82,8 @@ tags:
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
   - ocsf: actor.process.file.name
     cim: parent_process_name
   - ocsf: device.hostname
diff --git a/ssa_detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml b/ssa_detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml
index 9ff9684508..81a2c65715 100644
--- a/ssa_detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml
+++ b/ssa_detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml
@@ -18,17 +18,19 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
   process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
   "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
-  any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
-  null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
-  | eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
-  process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
-  "map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
-  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
-  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
-  any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
-  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
-  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where (match_regex(process_cmd_line, /(?i)S-1-1-0:/)=true OR match_regex(process_cmd_line,
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
+  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
+  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
+  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
+  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
+  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
+  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
+  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
+  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
+  (match_regex(process_cmd_line, /(?i)S-1-1-0:/)=true OR match_regex(process_cmd_line,
   /(?i)SYSTEM:/)=true OR match_regex(process_cmd_line, /(?i)everyone:/)=true) AND
   (process_file_name="icacls.exe" OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe")
   --finding_report--'
@@ -71,6 +73,8 @@ tags:
   mappings:
   - ocsf: process.pid
     cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
   - ocsf: process.file.name
     cim: process_name
   - ocsf: process.cmd_line
@@ -79,6 +83,8 @@ tags:
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
   - ocsf: actor.process.file.name
     cim: parent_process_name
   - ocsf: device.hostname
diff --git a/ssa_detections/endpoint/ssa___office_product_spawning_windows_script_host.yml b/ssa_detections/endpoint/ssa___office_product_spawning_windows_script_host.yml
index 7f6c0e6d87..e3cb0a6da6 100644
--- a/ssa_detections/endpoint/ssa___office_product_spawning_windows_script_host.yml
+++ b/ssa_detections/endpoint/ssa___office_product_spawning_windows_script_host.yml
@@ -15,21 +15,23 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
   process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
   "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
-  any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
-  null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
-  | eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
-  process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
-  "map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
-  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
-  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
-  any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
-  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
-  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where (process_file_name="cscript.exe" OR process_file_name="wscript.exe")
-  AND (match_regex(actor_process_file_name, /(?i)visio.exe/)=true OR match_regex(actor_process_file_name,
-  /(?i)mspub.exe/)=true OR match_regex(actor_process_file_name, /(?i)powerpnt.exe/)=true
-  OR match_regex(actor_process_file_name, /(?i)excel.exe/)=true OR match_regex(actor_process_file_name,
-  /(?i)winword.exe/)=true) --finding_report--'
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
+  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
+  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
+  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
+  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
+  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
+  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
+  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
+  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
+  (process_file_name="cscript.exe" OR process_file_name="wscript.exe") AND (match_regex(actor_process_file_name,
+  /(?i)visio.exe/)=true OR match_regex(actor_process_file_name, /(?i)mspub.exe/)=true
+  OR match_regex(actor_process_file_name, /(?i)powerpnt.exe/)=true OR match_regex(actor_process_file_name,
+  /(?i)excel.exe/)=true OR match_regex(actor_process_file_name, /(?i)winword.exe/)=true)
+  --finding_report--'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -73,6 +75,8 @@ tags:
   mappings:
   - ocsf: process.pid
     cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
   - ocsf: process.file.name
     cim: process_name
   - ocsf: process.cmd_line
@@ -81,6 +85,8 @@ tags:
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
   - ocsf: actor.process.file.name
     cim: parent_process_name
   - ocsf: device.hostname
diff --git a/ssa_detections/endpoint/ssa___resize_shadowstorage_volume.yml b/ssa_detections/endpoint/ssa___resize_shadowstorage_volume.yml
index 39f3d44e0b..971868db96 100644
--- a/ssa_detections/endpoint/ssa___resize_shadowstorage_volume.yml
+++ b/ssa_detections/endpoint/ssa___resize_shadowstorage_volume.yml
@@ -16,19 +16,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
   process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
   "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
-  any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
-  null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
-  | eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
-  process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
-  "map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
-  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
-  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
-  any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
-  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
-  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where like(process_cmd_line, "%shadowstorage%") AND like(process_cmd_line,
-  "%resize%") AND like(process_cmd_line, "%maxsize%") AND process_file_name="vssadmin.exe"
-  --finding_report--'
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
+  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
+  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
+  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
+  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
+  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
+  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
+  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
+  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
+  like(process_cmd_line, "%shadowstorage%") AND like(process_cmd_line, "%resize%")
+  AND like(process_cmd_line, "%maxsize%") AND process_file_name="vssadmin.exe" --finding_report--'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -71,6 +72,8 @@ tags:
   mappings:
   - ocsf: process.pid
     cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
   - ocsf: process.file.name
     cim: process_name
   - ocsf: process.cmd_line
@@ -79,6 +82,8 @@ tags:
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
   - ocsf: actor.process.file.name
     cim: parent_process_name
   - ocsf: device.hostname
diff --git a/ssa_detections/endpoint/ssa___sdelete_application_execution.yml b/ssa_detections/endpoint/ssa___sdelete_application_execution.yml
index c1fafa13ac..7904b73e1e 100644
--- a/ssa_detections/endpoint/ssa___sdelete_application_execution.yml
+++ b/ssa_detections/endpoint/ssa___sdelete_application_execution.yml
@@ -17,28 +17,30 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
   process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
   "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
-  any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
-  null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
-  | eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
-  process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
-  "map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
-  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
-  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
-  any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
-  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
-  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where (like(process_cmd_line, "%.xls%") OR like(process_cmd_line, "%.gz%")
-  OR like(process_cmd_line, "%.tar%") OR like(process_cmd_line, "%.rar%") OR like(process_cmd_line,
-  "%.zip%") OR like(process_cmd_line, "%.7z%") OR like(process_cmd_line, "%.bmp%")
-  OR like(process_cmd_line, "%.gif%") OR like(process_cmd_line, "%.png%") OR like(process_cmd_line,
-  "%.jpg%") OR like(process_cmd_line, "%.txt%") OR like(process_cmd_line, "%.log%")
-  OR like(process_cmd_line, "%.key%") OR like(process_cmd_line, "%.pdf%") OR like(process_cmd_line,
-  "%.rtf%") OR like(process_cmd_line, "%.ppt%") OR like(process_cmd_line, "%.xls%")
-  OR like(process_cmd_line, "%.doc%") OR like(process_cmd_line, "%-nobanner%") OR
-  like(process_cmd_line, "%/accepteula%") OR like(process_cmd_line, "%-z %") OR like(process_cmd_line,
-  "%-s %") OR like(process_cmd_line, "%-q %") OR like(process_cmd_line, "%-r %") OR
-  like(process_cmd_line, "%-p %") OR like(process_cmd_line, "%-f %") OR like(process_cmd_line,
-  "%-c %")) AND like(process_file_name, "%sdelete%") --finding_report--'
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
+  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
+  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
+  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
+  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
+  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
+  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
+  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
+  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
+  (like(process_cmd_line, "%.xls%") OR like(process_cmd_line, "%.gz%") OR like(process_cmd_line,
+  "%.tar%") OR like(process_cmd_line, "%.rar%") OR like(process_cmd_line, "%.zip%")
+  OR like(process_cmd_line, "%.7z%") OR like(process_cmd_line, "%.bmp%") OR like(process_cmd_line,
+  "%.gif%") OR like(process_cmd_line, "%.png%") OR like(process_cmd_line, "%.jpg%")
+  OR like(process_cmd_line, "%.txt%") OR like(process_cmd_line, "%.log%") OR like(process_cmd_line,
+  "%.key%") OR like(process_cmd_line, "%.pdf%") OR like(process_cmd_line, "%.rtf%")
+  OR like(process_cmd_line, "%.ppt%") OR like(process_cmd_line, "%.xls%") OR like(process_cmd_line,
+  "%.doc%") OR like(process_cmd_line, "%-nobanner%") OR like(process_cmd_line, "%/accepteula%")
+  OR like(process_cmd_line, "%-z %") OR like(process_cmd_line, "%-s %") OR like(process_cmd_line,
+  "%-q %") OR like(process_cmd_line, "%-r %") OR like(process_cmd_line, "%-p %") OR
+  like(process_cmd_line, "%-f %") OR like(process_cmd_line, "%-c %")) AND like(process_file_name,
+  "%sdelete%") --finding_report--'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
@@ -82,6 +84,8 @@ tags:
   mappings:
   - ocsf: process.pid
     cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
   - ocsf: process.file.name
     cim: process_name
   - ocsf: process.cmd_line
@@ -90,6 +94,8 @@ tags:
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
   - ocsf: actor.process.file.name
     cim: parent_process_name
   - ocsf: device.hostname
diff --git a/ssa_detections/endpoint/ssa___system_process_running_from_unexpected_location.yml b/ssa_detections/endpoint/ssa___system_process_running_from_unexpected_location.yml
index 23ece3af37..e924369736 100644
--- a/ssa_detections/endpoint/ssa___system_process_running_from_unexpected_location.yml
+++ b/ssa_detections/endpoint/ssa___system_process_running_from_unexpected_location.yml
@@ -18,55 +18,57 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
   process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
   "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
-  any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
-  null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
-  | eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
-  process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
-  "map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
-  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
-  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
-  any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
-  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
-  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where (process_file_name="xwizard.exe" OR process_file_name="xpsrchvw.exe"
-  OR process_file_name="xcopy.exe" OR process_file_name="wusa.exe" OR process_file_name="wuauclt.exe"
-  OR process_file_name="wuapp.exe" OR process_file_name="wuapihost.exe" OR process_file_name="wsqmcons.exe"
-  OR process_file_name="wsmprovhost.exe" OR process_file_name="wscript.exe" OR process_file_name="write.exe"
-  OR process_file_name="wpr.exe" OR process_file_name="wpnpinst.exe" OR process_file_name="wowreg32.exe"
-  OR process_file_name="wlrmdr.exe" OR process_file_name="wlanext.exe" OR process_file_name="wksprt.exe"
-  OR process_file_name="wkspbroker.exe" OR process_file_name="wisptis.exe" OR process_file_name="winver.exe"
-  OR process_file_name="winrshost.exe" OR process_file_name="winrs.exe" OR process_file_name="winresume.exe"
-  OR process_file_name="winlogon.exe" OR process_file_name="winload.exe" OR process_file_name="wininit.exe"
-  OR process_file_name="wimserv.exe" OR process_file_name="wifitask.exe" OR process_file_name="wiawow64.exe"
-  OR process_file_name="wiaacmgr.exe" OR process_file_name="whoami.exe" OR process_file_name="where.exe"
-  OR process_file_name="wextract.exe" OR process_file_name="wevtutil.exe" OR process_file_name="wermgr.exe"
-  OR process_file_name="wecutil.exe" OR process_file_name="wbengine.exe" OR process_file_name="wbadmin.exe"
-  OR process_file_name="waitfor.exe" OR process_file_name="w32tm.exe" OR process_file_name="vssadmin.exe"
-  OR process_file_name="vmicsvc.exe" OR process_file_name="verifiergui.exe" OR process_file_name="verifier.exe"
-  OR process_file_name="verclsid.exe" OR process_file_name="vdsldr.exe" OR process_file_name="vds.exe"
-  OR process_file_name="userinit.exe" OR process_file_name="upnpcont.exe" OR process_file_name="unregmp2.exe"
-  OR process_file_name="unlodctr.exe" OR process_file_name="ucsvc.exe" OR process_file_name="tzutil.exe"
-  OR process_file_name="tzsync.exe" OR process_file_name="typeperf.exe" OR process_file_name="tskill.exe"
-  OR process_file_name="tsdiscon.exe" OR process_file_name="tscon.exe" OR process_file_name="tracerpt.exe"
-  OR process_file_name="tpmvscmgrsvr.exe" OR process_file_name="tpmvscmgr.exe" OR
-  process_file_name="timeout.exe" OR process_file_name="tcmsetup.exe" OR process_file_name="taskmgr.exe"
-  OR process_file_name="tasklist.exe" OR process_file_name="taskkill.exe" OR process_file_name="taskhostw.exe"
-  OR process_file_name="taskhost.exe" OR process_file_name="taskeng.exe" OR process_file_name="takeown.exe"
-  OR process_file_name="tabcal.exe" OR process_file_name="systray.exe" OR process_file_name="systemreset.exe"
-  OR process_file_name="systeminfo.exe" OR process_file_name="syskey.exe" OR process_file_name="sxstrace.exe"
-  OR process_file_name="svchost.exe" OR process_file_name="subst.exe" OR process_file_name="srdelayed.exe"
-  OR process_file_name="spreview.exe" OR process_file_name="sppsvc.exe" OR process_file_name="spoolsv.exe"
-  OR process_file_name="spinstall.exe" OR process_file_name="sort.exe" OR process_file_name="snmptrap.exe"
-  OR process_file_name="smss.exe" OR process_file_name="slui.exe" OR process_file_name="sihost.exe"
-  OR process_file_name="sigverif.exe" OR process_file_name="shutdown.exe" OR process_file_name="shrpubw.exe"
-  OR process_file_name="shadow.exe" OR process_file_name="sfc.exe" OR process_file_name="setx.exe"
-  OR process_file_name="setupugc.exe" OR process_file_name="setupcl.exe" OR process_file_name="setspn.exe"
-  OR process_file_name="sethc.exe" OR process_file_name="sessionmsg.exe" OR process_file_name="services.exe"
-  OR process_file_name="secinit.exe" OR process_file_name="sdiagnhost.exe" OR process_file_name="sdclt.exe"
-  OR process_file_name="sdchange.exe" OR process_file_name="sdbinst.exe" OR process_file_name="schtasks.exe"
-  OR process_file_name="sc.exe" OR process_file_name="sbunattend.exe" OR process_file_name="rwinsta.exe"
-  OR process_file_name="runonce.exe" OR process_file_name="rundll32.exe" OR process_file_name="runas.exe"
-  OR process_file_name="rstrui.exe" OR process_file_name="rrinstaller.exe" OR process_file_name="rmttpmvscmgrsvr.exe"
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
+  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
+  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
+  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
+  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
+  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
+  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
+  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
+  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
+  (process_file_name="xwizard.exe" OR process_file_name="xpsrchvw.exe" OR process_file_name="xcopy.exe"
+  OR process_file_name="wusa.exe" OR process_file_name="wuauclt.exe" OR process_file_name="wuapp.exe"
+  OR process_file_name="wuapihost.exe" OR process_file_name="wsqmcons.exe" OR process_file_name="wsmprovhost.exe"
+  OR process_file_name="wscript.exe" OR process_file_name="write.exe" OR process_file_name="wpr.exe"
+  OR process_file_name="wpnpinst.exe" OR process_file_name="wowreg32.exe" OR process_file_name="wlrmdr.exe"
+  OR process_file_name="wlanext.exe" OR process_file_name="wksprt.exe" OR process_file_name="wkspbroker.exe"
+  OR process_file_name="wisptis.exe" OR process_file_name="winver.exe" OR process_file_name="winrshost.exe"
+  OR process_file_name="winrs.exe" OR process_file_name="winresume.exe" OR process_file_name="winlogon.exe"
+  OR process_file_name="winload.exe" OR process_file_name="wininit.exe" OR process_file_name="wimserv.exe"
+  OR process_file_name="wifitask.exe" OR process_file_name="wiawow64.exe" OR process_file_name="wiaacmgr.exe"
+  OR process_file_name="whoami.exe" OR process_file_name="where.exe" OR process_file_name="wextract.exe"
+  OR process_file_name="wevtutil.exe" OR process_file_name="wermgr.exe" OR process_file_name="wecutil.exe"
+  OR process_file_name="wbengine.exe" OR process_file_name="wbadmin.exe" OR process_file_name="waitfor.exe"
+  OR process_file_name="w32tm.exe" OR process_file_name="vssadmin.exe" OR process_file_name="vmicsvc.exe"
+  OR process_file_name="verifiergui.exe" OR process_file_name="verifier.exe" OR process_file_name="verclsid.exe"
+  OR process_file_name="vdsldr.exe" OR process_file_name="vds.exe" OR process_file_name="userinit.exe"
+  OR process_file_name="upnpcont.exe" OR process_file_name="unregmp2.exe" OR process_file_name="unlodctr.exe"
+  OR process_file_name="ucsvc.exe" OR process_file_name="tzutil.exe" OR process_file_name="tzsync.exe"
+  OR process_file_name="typeperf.exe" OR process_file_name="tskill.exe" OR process_file_name="tsdiscon.exe"
+  OR process_file_name="tscon.exe" OR process_file_name="tracerpt.exe" OR process_file_name="tpmvscmgrsvr.exe"
+  OR process_file_name="tpmvscmgr.exe" OR process_file_name="timeout.exe" OR process_file_name="tcmsetup.exe"
+  OR process_file_name="taskmgr.exe" OR process_file_name="tasklist.exe" OR process_file_name="taskkill.exe"
+  OR process_file_name="taskhostw.exe" OR process_file_name="taskhost.exe" OR process_file_name="taskeng.exe"
+  OR process_file_name="takeown.exe" OR process_file_name="tabcal.exe" OR process_file_name="systray.exe"
+  OR process_file_name="systemreset.exe" OR process_file_name="systeminfo.exe" OR
+  process_file_name="syskey.exe" OR process_file_name="sxstrace.exe" OR process_file_name="svchost.exe"
+  OR process_file_name="subst.exe" OR process_file_name="srdelayed.exe" OR process_file_name="spreview.exe"
+  OR process_file_name="sppsvc.exe" OR process_file_name="spoolsv.exe" OR process_file_name="spinstall.exe"
+  OR process_file_name="sort.exe" OR process_file_name="snmptrap.exe" OR process_file_name="smss.exe"
+  OR process_file_name="slui.exe" OR process_file_name="sihost.exe" OR process_file_name="sigverif.exe"
+  OR process_file_name="shutdown.exe" OR process_file_name="shrpubw.exe" OR process_file_name="shadow.exe"
+  OR process_file_name="sfc.exe" OR process_file_name="setx.exe" OR process_file_name="setupugc.exe"
+  OR process_file_name="setupcl.exe" OR process_file_name="setspn.exe" OR process_file_name="sethc.exe"
+  OR process_file_name="sessionmsg.exe" OR process_file_name="services.exe" OR process_file_name="secinit.exe"
+  OR process_file_name="sdiagnhost.exe" OR process_file_name="sdclt.exe" OR process_file_name="sdchange.exe"
+  OR process_file_name="sdbinst.exe" OR process_file_name="schtasks.exe" OR process_file_name="sc.exe"
+  OR process_file_name="sbunattend.exe" OR process_file_name="rwinsta.exe" OR process_file_name="runonce.exe"
+  OR process_file_name="rundll32.exe" OR process_file_name="runas.exe" OR process_file_name="rstrui.exe"
+  OR process_file_name="rrinstaller.exe" OR process_file_name="rmttpmvscmgrsvr.exe"
   OR process_file_name="resmon.exe" OR process_file_name="reset.exe" OR process_file_name="replace.exe"
   OR process_file_name="repair-bde.exe" OR process_file_name="relog.exe" OR process_file_name="rekeywiz.exe"
   OR process_file_name="regsvr32.exe" OR process_file_name="regini.exe" OR process_file_name="regedt32.exe"
@@ -238,8 +240,8 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   OR process_file_name="axinstui.exe" OR process_file_name="autoworkplace.exe" OR
   process_file_name="authhost.exe" OR process_file_name="atbroker.exe" OR process_file_name="applicationframehost.exe"
   OR process_file_name="adaptertroubleshooter.exe" OR process_file_name="arp.exe")
-  AND (NOT match_regex(process_path, /(?i)\\windows\\syswow64/)=true) AND (NOT match_regex(process_path,
-  /(?i)\\windows\\system32/)=true) --finding_report--'
+  AND (NOT match_regex(process_file_path, /(?i)\\windows\\syswow64/)=true) AND (NOT
+  match_regex(process_file_path, /(?i)\\windows\\system32/)=true) --finding_report--'
 how_to_implement: Collect endpoint data such as sysmon or 4688 events.
 known_false_positives: None
 references: []
@@ -259,6 +261,8 @@ tags:
     type: User Name
   - name: device.hostname
     type: Hostname
+  - name: process.file.path
+    type: File
   - name: process.file.name
     type: File Name
   - name: process.cmd_line
@@ -268,6 +272,7 @@ tags:
   required_fields:
   - process.user.name
   - device.hostname
+  - process.file.path
   - process.file.name
   - process.cmd_line
   risk_score: 56
@@ -275,6 +280,8 @@ tags:
   mappings:
   - ocsf: process.pid
     cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
   - ocsf: process.file.name
     cim: process_name
   - ocsf: process.cmd_line
@@ -283,6 +290,8 @@ tags:
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
   - ocsf: actor.process.file.name
     cim: parent_process_name
   - ocsf: device.hostname
diff --git a/ssa_detections/endpoint/ssa___wbadmin_delete_system_backups.yml b/ssa_detections/endpoint/ssa___wbadmin_delete_system_backups.yml
index 87d248f4e9..ed6e03f0fe 100644
--- a/ssa_detections/endpoint/ssa___wbadmin_delete_system_backups.yml
+++ b/ssa_detections/endpoint/ssa___wbadmin_delete_system_backups.yml
@@ -15,17 +15,19 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
   process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
   "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
-  any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
-  null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
-  | eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
-  process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
-  "map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
-  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
-  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
-  any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
-  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
-  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where process_file_name="wbadmin.exe" AND (like(process_cmd_line, "%systemstatebackup%")
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
+  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
+  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
+  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
+  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
+  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
+  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
+  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
+  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
+  process_file_name="wbadmin.exe" AND (like(process_cmd_line, "%systemstatebackup%")
   OR like(process_cmd_line, "%catalog%") OR like(process_cmd_line, "%delete%")) --finding_report--'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
@@ -69,6 +71,8 @@ tags:
   mappings:
   - ocsf: process.pid
     cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
   - ocsf: process.file.name
     cim: process_name
   - ocsf: process.cmd_line
@@ -77,6 +81,8 @@ tags:
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
   - ocsf: actor.process.file.name
     cim: parent_process_name
   - ocsf: device.hostname
diff --git a/ssa_detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml b/ssa_detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml
index b33f8f151c..a6a32dd284 100644
--- a/ssa_detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml
+++ b/ssa_detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml
@@ -15,17 +15,19 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
   process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
   "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
-  any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
-  null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
-  | eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
-  process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
-  "map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
-  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
-  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
-  any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
-  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
-  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where (match_regex(process_cmd_line, /(?i)powershell/)=true OR match_regex(process_cmd_line,
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
+  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
+  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
+  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
+  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
+  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
+  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
+  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
+  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
+  (match_regex(process_cmd_line, /(?i)powershell/)=true OR match_regex(process_cmd_line,
   /(?i)setup/)=true OR match_regex(process_cmd_line, /(?i)application/)=true OR match_regex(process_cmd_line,
   /(?i)sysmon/)=true OR match_regex(process_cmd_line, /(?i)system/)=true OR match_regex(process_cmd_line,
   /(?i)security/)=true) AND like(process_cmd_line, "% cl %") AND process_file_name="wevtutil.exe"
@@ -75,6 +77,8 @@ tags:
   mappings:
   - ocsf: process.pid
     cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
   - ocsf: process.file.name
     cim: process_name
   - ocsf: process.cmd_line
@@ -83,6 +87,8 @@ tags:
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
   - ocsf: actor.process.file.name
     cim: parent_process_name
   - ocsf: device.hostname
diff --git a/ssa_detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml b/ssa_detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml
index f0800ad9af..62bc6ab0b2 100644
--- a/ssa_detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml
+++ b/ssa_detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml
@@ -15,18 +15,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
   process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
   "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
-  any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
-  null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
-  | eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
-  process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
-  "map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
-  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
-  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
-  any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
-  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
-  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where like(process_cmd_line, "%/e:false%") AND like(process_cmd_line, "%
-  sl %") AND process_file_name="wevtutil.exe" --finding_report--'
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
+  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
+  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
+  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
+  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
+  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
+  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
+  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
+  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
+  like(process_cmd_line, "%/e:false%") AND like(process_cmd_line, "% sl %") AND process_file_name="wevtutil.exe"
+  --finding_report--'
 how_to_implement: You must be ingesting data that records process activity from your
   hosts to populate the Endpoint data model in the Processes node. You must also be
   ingesting logs with both the process name and command line from your endpoints.
@@ -71,6 +73,8 @@ tags:
   mappings:
   - ocsf: process.pid
     cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
   - ocsf: process.file.name
     cim: process_name
   - ocsf: process.cmd_line
@@ -79,6 +83,8 @@ tags:
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
   - ocsf: actor.process.file.name
     cim: parent_process_name
   - ocsf: device.hostname
diff --git a/ssa_detections/endpoint/ssa___windows_bits_job_persistence.yml b/ssa_detections/endpoint/ssa___windows_bits_job_persistence.yml
index 506d11b20c..7f7b8a7d43 100644
--- a/ssa_detections/endpoint/ssa___windows_bits_job_persistence.yml
+++ b/ssa_detections/endpoint/ssa___windows_bits_job_persistence.yml
@@ -19,17 +19,19 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
   process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
   "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
-  any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
-  null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
-  | eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
-  process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
-  "map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
-  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
-  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
-  any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
-  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
-  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where (like(process_cmd_line, "%resume%") OR like(process_cmd_line, "%setcustomheaders%")
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
+  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
+  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
+  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
+  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
+  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
+  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
+  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
+  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
+  (like(process_cmd_line, "%resume%") OR like(process_cmd_line, "%setcustomheaders%")
   OR like(process_cmd_line, "%setminretrydelay%") OR like(process_cmd_line, "%setnotifycmdline%")
   OR like(process_cmd_line, "%setnotifyflags%") OR like(process_cmd_line, "%addfile%")
   OR like(process_cmd_line, "%create%")) AND process_file_name="bitsadmin.exe" --finding_report--'
@@ -78,6 +80,8 @@ tags:
   mappings:
   - ocsf: process.pid
     cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
   - ocsf: process.file.name
     cim: process_name
   - ocsf: process.cmd_line
@@ -86,6 +90,8 @@ tags:
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
   - ocsf: actor.process.file.name
     cim: parent_process_name
   - ocsf: device.hostname
diff --git a/ssa_detections/endpoint/ssa___windows_bitsadmin_download_file.yml b/ssa_detections/endpoint/ssa___windows_bitsadmin_download_file.yml
index a549180146..1d6a87c98d 100644
--- a/ssa_detections/endpoint/ssa___windows_bitsadmin_download_file.yml
+++ b/ssa_detections/endpoint/ssa___windows_bitsadmin_download_file.yml
@@ -24,18 +24,19 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
   process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
   "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
-  any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
-  null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
-  | eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
-  process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
-  "map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
-  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
-  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
-  any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
-  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
-  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where like(process_cmd_line, "%transfer%") AND process_file_name="bitsadmin.exe"
-  --finding_report--'
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
+  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
+  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
+  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
+  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
+  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
+  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
+  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
+  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
+  like(process_cmd_line, "%transfer%") AND process_file_name="bitsadmin.exe" --finding_report--'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
@@ -83,6 +84,8 @@ tags:
   mappings:
   - ocsf: process.pid
     cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
   - ocsf: process.file.name
     cim: process_name
   - ocsf: process.cmd_line
@@ -91,6 +94,8 @@ tags:
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
   - ocsf: actor.process.file.name
     cim: parent_process_name
   - ocsf: device.hostname
diff --git a/ssa_detections/endpoint/ssa___windows_certutil_decode_file.yml b/ssa_detections/endpoint/ssa___windows_certutil_decode_file.yml
index 070c8273bc..13a1637459 100644
--- a/ssa_detections/endpoint/ssa___windows_certutil_decode_file.yml
+++ b/ssa_detections/endpoint/ssa___windows_certutil_decode_file.yml
@@ -20,18 +20,19 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
   process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
   "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
-  any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
-  null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
-  | eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
-  process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
-  "map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
-  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
-  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
-  any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
-  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
-  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where like(process_cmd_line, "%decode%") AND process_file_name="certutil.exe"
-  --finding_report--'
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
+  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
+  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
+  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
+  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
+  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
+  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
+  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
+  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
+  like(process_cmd_line, "%decode%") AND process_file_name="certutil.exe" --finding_report--'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
@@ -78,6 +79,8 @@ tags:
   mappings:
   - ocsf: process.pid
     cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
   - ocsf: process.file.name
     cim: process_name
   - ocsf: process.cmd_line
@@ -86,6 +89,8 @@ tags:
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
   - ocsf: actor.process.file.name
     cim: parent_process_name
   - ocsf: device.hostname
diff --git a/ssa_detections/endpoint/ssa___windows_certutil_urlcache_download.yml b/ssa_detections/endpoint/ssa___windows_certutil_urlcache_download.yml
index c4fb1908e0..411b5fc0f4 100644
--- a/ssa_detections/endpoint/ssa___windows_certutil_urlcache_download.yml
+++ b/ssa_detections/endpoint/ssa___windows_certutil_urlcache_download.yml
@@ -19,19 +19,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
   process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
   "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
-  any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
-  null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
-  | eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
-  process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
-  "map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
-  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
-  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
-  any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
-  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
-  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where (process_file_name="certutil.exe" AND like(process_cmd_line, "%split%")
-  AND like(process_cmd_line, "%urlcache%")) OR like(process_cmd_line, "%urlcache%")
-  --finding_report--'
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
+  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
+  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
+  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
+  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
+  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
+  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
+  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
+  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
+  (process_file_name="certutil.exe" AND like(process_cmd_line, "%split%") AND like(process_cmd_line,
+  "%urlcache%")) OR like(process_cmd_line, "%urlcache%") --finding_report--'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node.
@@ -74,6 +75,8 @@ tags:
   mappings:
   - ocsf: process.pid
     cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
   - ocsf: process.file.name
     cim: process_name
   - ocsf: process.cmd_line
@@ -82,6 +85,8 @@ tags:
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
   - ocsf: actor.process.file.name
     cim: parent_process_name
   - ocsf: device.hostname
diff --git a/ssa_detections/endpoint/ssa___windows_certutil_verifyctl_download.yml b/ssa_detections/endpoint/ssa___windows_certutil_verifyctl_download.yml
index 134e1456ef..f7acc9e1f8 100644
--- a/ssa_detections/endpoint/ssa___windows_certutil_verifyctl_download.yml
+++ b/ssa_detections/endpoint/ssa___windows_certutil_verifyctl_download.yml
@@ -19,19 +19,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
   process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
   "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
-  any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
-  null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
-  | eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
-  process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
-  "map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
-  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
-  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
-  any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
-  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
-  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where (process_file_name="certutil.exe" AND like(process_cmd_line, "%split%")
-  AND like(process_cmd_line, "%verifyctl%")) OR like(process_cmd_line, "%verifyctl%")
-  --finding_report--'
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
+  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
+  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
+  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
+  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
+  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
+  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
+  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
+  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
+  (process_file_name="certutil.exe" AND like(process_cmd_line, "%split%") AND like(process_cmd_line,
+  "%verifyctl%")) OR like(process_cmd_line, "%verifyctl%") --finding_report--'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node.
@@ -75,6 +76,8 @@ tags:
   mappings:
   - ocsf: process.pid
     cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
   - ocsf: process.file.name
     cim: process_name
   - ocsf: process.cmd_line
@@ -83,6 +86,8 @@ tags:
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
   - ocsf: actor.process.file.name
     cim: parent_process_name
   - ocsf: device.hostname
diff --git a/ssa_detections/endpoint/ssa___windows_com_hijacking_inprocserver32_modification.yml b/ssa_detections/endpoint/ssa___windows_com_hijacking_inprocserver32_modification.yml
index b8c051aa0a..39b98cefba 100644
--- a/ssa_detections/endpoint/ssa___windows_com_hijacking_inprocserver32_modification.yml
+++ b/ssa_detections/endpoint/ssa___windows_com_hijacking_inprocserver32_modification.yml
@@ -20,17 +20,19 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
   process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
   "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
-  any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
-  null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
-  | eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
-  process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
-  "map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
-  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
-  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
-  any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
-  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
-  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where match_regex(process_cmd_line, /(?i)inprocserver32/)=true AND process_file_name="reg.exe"
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
+  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
+  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
+  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
+  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
+  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
+  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
+  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
+  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
+  match_regex(process_cmd_line, /(?i)inprocserver32/)=true AND process_file_name="reg.exe"
   --finding_report--'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
@@ -73,6 +75,8 @@ tags:
   mappings:
   - ocsf: process.pid
     cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
   - ocsf: process.file.name
     cim: process_name
   - ocsf: process.cmd_line
@@ -81,6 +85,8 @@ tags:
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
   - ocsf: actor.process.file.name
     cim: parent_process_name
   - ocsf: device.hostname
diff --git a/ssa_detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml b/ssa_detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml
index 986369cc0e..1edd099121 100644
--- a/ssa_detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml
+++ b/ssa_detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml
@@ -30,20 +30,21 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
   process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
   "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
-  any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
-  null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
-  | eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
-  process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
-  "map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
-  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
-  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
-  any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
-  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
-  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where (like(process_cmd_line, "%-F %") OR like(process_cmd_line, "%--data
-  %") OR like(process_cmd_line, "%-d %") OR like(process_cmd_line, "%--upload-file
-  %") OR like(process_cmd_line, "%-T %")) AND match_regex(process_file_name, /(?i)curl.exe/)=true
-  --finding_report--'
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
+  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
+  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
+  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
+  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
+  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
+  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
+  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
+  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
+  (like(process_cmd_line, "%-F %") OR like(process_cmd_line, "%--data %") OR like(process_cmd_line,
+  "%-d %") OR like(process_cmd_line, "%--upload-file %") OR like(process_cmd_line,
+  "%-T %")) AND match_regex(process_file_name, /(?i)curl.exe/)=true --finding_report--'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint_Processess` datamodel.
@@ -86,6 +87,8 @@ tags:
   mappings:
   - ocsf: process.pid
     cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
   - ocsf: process.file.name
     cim: process_name
   - ocsf: process.cmd_line
@@ -94,6 +97,8 @@ tags:
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
   - ocsf: actor.process.file.name
     cim: parent_process_name
   - ocsf: device.hostname
diff --git a/ssa_detections/endpoint/ssa___windows_defender_tools_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_defender_tools_in_non_standard_path.yml
index d367a3a87a..e7ddf7c123 100644
--- a/ssa_detections/endpoint/ssa___windows_defender_tools_in_non_standard_path.yml
+++ b/ssa_detections/endpoint/ssa___windows_defender_tools_in_non_standard_path.yml
@@ -14,18 +14,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
   process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
   "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
-  any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
-  null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
-  | eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
-  process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
-  "map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
-  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
-  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
-  any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
-  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
-  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where match_regex(process_file_name, /(?i)mpcmdrun.exe/)=true AND (NOT match_regex(process_path,
-  /(?i)\\windows defender/)=true) AND (NOT match_regex(process_path, /(?i)\\microsoft\\windows
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
+  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
+  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
+  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
+  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
+  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
+  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
+  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
+  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
+  match_regex(process_file_name, /(?i)mpcmdrun.exe/)=true AND (NOT match_regex(process_file_path,
+  /(?i)\\windows defender/)=true) AND (NOT match_regex(process_file_path, /(?i)\\microsoft\\windows
   defender\\platform/)=true) --finding_report--'
 how_to_implement: Collect endpoint data such as sysmon or 4688 events.
 known_false_positives: False positives may be present and filtering may be required.
@@ -48,6 +50,8 @@ tags:
     type: User Name
   - name: device.hostname
     type: Hostname
+  - name: process.file.path
+    type: File
   - name: process.file.name
     type: File Name
   - name: process.cmd_line
@@ -57,6 +61,7 @@ tags:
   required_fields:
   - process.user.name
   - device.hostname
+  - process.file.path
   - process.file.name
   - process.cmd_line
   risk_score: 56
@@ -64,6 +69,8 @@ tags:
   mappings:
   - ocsf: process.pid
     cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
   - ocsf: process.file.name
     cim: process_name
   - ocsf: process.cmd_line
@@ -72,6 +79,8 @@ tags:
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
   - ocsf: actor.process.file.name
     cim: parent_process_name
   - ocsf: device.hostname
diff --git a/ssa_detections/endpoint/ssa___windows_diskshadow_proxy_execution.yml b/ssa_detections/endpoint/ssa___windows_diskshadow_proxy_execution.yml
index b8f414d07f..e8f6cdb88e 100644
--- a/ssa_detections/endpoint/ssa___windows_diskshadow_proxy_execution.yml
+++ b/ssa_detections/endpoint/ssa___windows_diskshadow_proxy_execution.yml
@@ -18,18 +18,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
   process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
   "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
-  any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
-  null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
-  | eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
-  process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
-  "map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
-  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
-  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
-  any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
-  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
-  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where (like(process_cmd_line, "%/s%") OR like(process_cmd_line, "%-S%"))
-  AND process_file_name="diskshadow.exe" --finding_report--'
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
+  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
+  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
+  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
+  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
+  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
+  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
+  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
+  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
+  (like(process_cmd_line, "%/s%") OR like(process_cmd_line, "%-S%")) AND process_file_name="diskshadow.exe"
+  --finding_report--'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on processes that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint_Processess` datamodel.
@@ -68,6 +70,8 @@ tags:
   mappings:
   - ocsf: process.pid
     cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
   - ocsf: process.file.name
     cim: process_name
   - ocsf: process.cmd_line
@@ -76,6 +80,8 @@ tags:
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
   - ocsf: actor.process.file.name
     cim: parent_process_name
   - ocsf: device.hostname
diff --git a/ssa_detections/endpoint/ssa___windows_dotnet_binary_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_dotnet_binary_in_non_standard_path.yml
index d518e46c51..9885fa57ab 100644
--- a/ssa_detections/endpoint/ssa___windows_dotnet_binary_in_non_standard_path.yml
+++ b/ssa_detections/endpoint/ssa___windows_dotnet_binary_in_non_standard_path.yml
@@ -18,17 +18,19 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
   process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
   "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
-  any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
-  null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
-  | eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
-  process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
-  "map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
-  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
-  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
-  any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
-  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
-  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where (match_regex(process_file_name, /(?i)MSBuild.exe/)=true OR match_regex(process_file_name,
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
+  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
+  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
+  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
+  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
+  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
+  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
+  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
+  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
+  (match_regex(process_file_name, /(?i)MSBuild.exe/)=true OR match_regex(process_file_name,
   /(?i)comsvcconfig.exe/)=true OR match_regex(process_file_name, /(?i)dfsradmin.exe/)=true
   OR match_regex(process_file_name, /(?i)dfsvc.exe/)=true OR match_regex(process_file_name,
   /(?i)microsoft.workflow.compiler.exe/)=true OR match_regex(process_file_name, /(?i)smsvchost.exe/)=true
@@ -57,11 +59,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   OR match_regex(process_file_name, /(?i)microsoft.activedirectory.webservices.exe/)=true
   OR match_regex(process_file_name, /(?i)iisual.exe/)=true OR match_regex(process_file_name,
   /(?i)filehistory.exe/)=true OR match_regex(process_file_name, /(?i)secureassessmentbrowser.exe/)=true)
-  AND (NOT (match_regex(process_path, /(?i)\\windows\\system32/)=true OR match_regex(process_path,
-  /(?i)\\windows\\syswow64/)=true OR match_regex(process_path, /(?i)\\windows\\adws/)=true
-  OR match_regex(process_path, /(?i)\\windows\\networkcontroller/)=true OR match_regex(process_path,
-  /(?i)\\windows\\systemapps/)=true OR match_regex(process_path, /(?i)\\winsxs/)=true
-  OR match_regex(process_path, /(?i)\\microsoft.net/)=true)) --finding_report--'
+  AND (NOT (match_regex(process_file_path, /(?i)\\windows\\system32/)=true OR match_regex(process_file_path,
+  /(?i)\\windows\\syswow64/)=true OR match_regex(process_file_path, /(?i)\\windows\\adws/)=true
+  OR match_regex(process_file_path, /(?i)\\windows\\networkcontroller/)=true OR match_regex(process_file_path,
+  /(?i)\\windows\\systemapps/)=true OR match_regex(process_file_path, /(?i)\\winsxs/)=true
+  OR match_regex(process_file_path, /(?i)\\microsoft.net/)=true)) --finding_report--'
 how_to_implement: Collect endpoint data such as sysmon or 4688 events.
 known_false_positives: False positives may be present and filtering may be required.
   Certain utilities will run from non-standard paths based on the third-party application
@@ -93,6 +95,8 @@ tags:
     type: User Name
   - name: device.hostname
     type: Hostname
+  - name: process.file.path
+    type: File
   - name: process.file.name
     type: File Name
   - name: process.cmd_line
@@ -102,6 +106,7 @@ tags:
   required_fields:
   - process.user.name
   - device.hostname
+  - process.file.path
   - process.file.name
   - process.cmd_line
   risk_score: 49
@@ -109,6 +114,8 @@ tags:
   mappings:
   - ocsf: process.pid
     cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
   - ocsf: process.file.name
     cim: process_name
   - ocsf: process.cmd_line
@@ -117,6 +124,8 @@ tags:
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
   - ocsf: actor.process.file.name
     cim: parent_process_name
   - ocsf: device.hostname
diff --git a/ssa_detections/endpoint/ssa___windows_exchange_powershell_module_usage.yml b/ssa_detections/endpoint/ssa___windows_exchange_powershell_module_usage.yml
index bc45ceb440..75eb0247d8 100644
--- a/ssa_detections/endpoint/ssa___windows_exchange_powershell_module_usage.yml
+++ b/ssa_detections/endpoint/ssa___windows_exchange_powershell_module_usage.yml
@@ -34,17 +34,19 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
   process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
   "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
-  any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
-  null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
-  | eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
-  process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
-  "map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
-  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
-  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
-  any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
-  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
-  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where match_regex(process_cmd_line, /(?i)get-recipient/)=true OR match_regex(process_cmd_line,
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
+  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
+  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
+  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
+  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
+  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
+  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
+  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
+  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
+  match_regex(process_cmd_line, /(?i)get-recipient/)=true OR match_regex(process_cmd_line,
   /(?i)new-mailboxsearch/)=true OR match_regex(process_cmd_line, /(?i)new-managementroleassignment/)=true
   OR match_regex(process_cmd_line, /(?i)new-mailboxexportrequest/)=true --finding_report--'
 how_to_implement: To successfully implement this analytic, you will need to enable
@@ -91,6 +93,8 @@ tags:
   mappings:
   - ocsf: process.pid
     cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
   - ocsf: process.file.name
     cim: process_name
   - ocsf: process.cmd_line
@@ -99,6 +103,8 @@ tags:
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
   - ocsf: actor.process.file.name
     cim: parent_process_name
   - ocsf: device.hostname
diff --git a/ssa_detections/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml b/ssa_detections/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml
index 41765cd899..700e24580e 100644
--- a/ssa_detections/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml
+++ b/ssa_detections/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml
@@ -17,22 +17,24 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
   process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
   "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
-  any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
-  null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
-  | eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
-  process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
-  "map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
-  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
-  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
-  any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
-  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
-  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where ((like(process_cmd_line, "%ms-msdt:/id%") OR like(process_cmd_line,
-  "%ms-msdt:-id%") OR like(process_cmd_line, "%ms-msdt:/id%") OR like(process_cmd_line,
-  "%ms-msdt:%") OR like(process_cmd_line, "%msdt%")) AND process_file_name="msdt.exe")
-  AND (match_regex(process_cmd_line, /(?i).xml/)=true OR match_regex(process_cmd_line,
-  /(?i)it_rebrowseforfile=/)=true OR match_regex(process_cmd_line, /(?i)it_browseforfile=/)=true)
-  AND match_regex(process_cmd_line, /(?i)pcwdiagnostic/)=true --finding_report--'
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
+  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
+  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
+  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
+  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
+  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
+  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
+  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
+  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
+  ((like(process_cmd_line, "%ms-msdt:/id%") OR like(process_cmd_line, "%ms-msdt:-id%")
+  OR like(process_cmd_line, "%ms-msdt:/id%") OR like(process_cmd_line, "%ms-msdt:%")
+  OR like(process_cmd_line, "%msdt%")) AND process_file_name="msdt.exe") AND (match_regex(process_cmd_line,
+  /(?i).xml/)=true OR match_regex(process_cmd_line, /(?i)it_rebrowseforfile=/)=true
+  OR match_regex(process_cmd_line, /(?i)it_browseforfile=/)=true) AND match_regex(process_cmd_line,
+  /(?i)pcwdiagnostic/)=true --finding_report--'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -77,6 +79,8 @@ tags:
   mappings:
   - ocsf: process.pid
     cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
   - ocsf: process.file.name
     cim: process_name
   - ocsf: process.cmd_line
@@ -85,6 +89,8 @@ tags:
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
   - ocsf: actor.process.file.name
     cim: parent_process_name
   - ocsf: device.hostname
diff --git a/ssa_detections/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml b/ssa_detections/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml
index 553ba70e09..b81b785869 100644
--- a/ssa_detections/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml
+++ b/ssa_detections/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml
@@ -20,18 +20,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
   process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
   "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
-  any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
-  null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
-  | eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
-  process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
-  "map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
-  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
-  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
-  any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
-  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
-  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where (like(process_cmd_line, "%https://%") OR like(process_cmd_line, "%http://%"))
-  AND process_file_name="explorer.exe" --finding_report--'
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
+  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
+  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
+  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
+  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
+  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
+  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
+  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
+  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
+  (like(process_cmd_line, "%https://%") OR like(process_cmd_line, "%http://%")) AND
+  process_file_name="explorer.exe" --finding_report--'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints.
@@ -71,6 +73,8 @@ tags:
   mappings:
   - ocsf: process.pid
     cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
   - ocsf: process.file.name
     cim: process_name
   - ocsf: process.cmd_line
@@ -79,6 +83,8 @@ tags:
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
   - ocsf: actor.process.file.name
     cim: parent_process_name
   - ocsf: device.hostname
diff --git a/ssa_detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml
index 6ae1af66c3..4be58a65d6 100644
--- a/ssa_detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml
+++ b/ssa_detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml
@@ -17,19 +17,21 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
   process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
   "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
-  any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
-  null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
-  | eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
-  process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
-  "map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
-  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
-  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
-  any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
-  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
-  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where (process_file_name="bitsadmin.exe" OR process_file_name="certoc.exe"
-  OR process_file_name="certreq.exe" OR process_file_name="certutil.exe" OR process_file_name="cmdkey.exe"
-  OR process_file_name="cmdl32.exe" OR process_file_name="cmstp.exe" OR process_file_name="configsecuritypolicy.exe"
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
+  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
+  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
+  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
+  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
+  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
+  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
+  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
+  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
+  (process_file_name="bitsadmin.exe" OR process_file_name="certoc.exe" OR process_file_name="certreq.exe"
+  OR process_file_name="certutil.exe" OR process_file_name="cmdkey.exe" OR process_file_name="cmdl32.exe"
+  OR process_file_name="cmstp.exe" OR process_file_name="configsecuritypolicy.exe"
   OR process_file_name="control.exe" OR process_file_name="cscript.exe" OR process_file_name="datasvcutil.exe"
   OR process_file_name="desktopimgdownldr.exe" OR process_file_name="dfsvc.exe" OR
   process_file_name="diantz.exe" OR process_file_name="diskshadow.exe" OR process_file_name="dllhost.exe"
@@ -56,11 +58,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   OR process_file_name="verclsid.exe" OR process_file_name="wab.exe" OR process_file_name="wlrmdr.exe"
   OR process_file_name="wmic.exe" OR process_file_name="workfolders.exe" OR process_file_name="wscript.exe"
   OR process_file_name="wsreset.exe" OR process_file_name="wuauclt.exe" OR process_file_name="xwizard.exe")
-  AND (NOT (match_regex(process_path, /(?i)(?i)\\windows\\system32/)=true OR match_regex(process_path,
-  /(?i)(?i)\\windows\\syswow64/)=true OR match_regex(process_path, /(?i)(?i)\\windows\\networkcontrolle/)=true
-  OR match_regex(process_path, /(?i)(?i)\\windows\\systemapps/)=true OR match_regex(process_path,
-  /(?i)(?i)\\winsxs/)=true OR match_regex(process_path, /(?i)(?i)\\microsoft.net/)=true))
-  --finding_report--'
+  AND (NOT (match_regex(process_file_path, /(?i)(?i)\\windows\\system32/)=true OR
+  match_regex(process_file_path, /(?i)(?i)\\windows\\syswow64/)=true OR match_regex(process_file_path,
+  /(?i)(?i)\\windows\\networkcontrolle/)=true OR match_regex(process_file_path, /(?i)(?i)\\windows\\systemapps/)=true
+  OR match_regex(process_file_path, /(?i)(?i)\\winsxs/)=true OR match_regex(process_file_path,
+  /(?i)(?i)\\microsoft.net/)=true)) --finding_report--'
 how_to_implement: Collect endpoint data such as sysmon or 4688 events.
 known_false_positives: False positives may be present and filtering may be required.
   Certain utilities will run from non-standard paths based on the third-party application
@@ -90,6 +92,8 @@ tags:
     type: User Name
   - name: device.hostname
     type: Hostname
+  - name: process.file.path
+    type: File
   - name: process.file.name
     type: File Name
   - name: process.cmd_line
@@ -99,6 +103,7 @@ tags:
   required_fields:
   - process.user.name
   - device.hostname
+  - process.file.path
   - process.file.name
   - process.cmd_line
   risk_score: 49
@@ -106,6 +111,8 @@ tags:
   mappings:
   - ocsf: process.pid
     cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
   - ocsf: process.file.name
     cim: process_name
   - ocsf: process.cmd_line
@@ -114,6 +121,8 @@ tags:
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
   - ocsf: actor.process.file.name
     cim: parent_process_name
   - ocsf: device.hostname
diff --git a/ssa_detections/endpoint/ssa___windows_mshta_child_process.yml b/ssa_detections/endpoint/ssa___windows_mshta_child_process.yml
index e1e199a879..53e4ecc402 100644
--- a/ssa_detections/endpoint/ssa___windows_mshta_child_process.yml
+++ b/ssa_detections/endpoint/ssa___windows_mshta_child_process.yml
@@ -16,21 +16,23 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
   process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
   "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
-  any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
-  null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
-  | eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
-  process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
-  "map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
-  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
-  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
-  any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
-  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
-  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where (process_file_name="wscript.exe" OR process_file_name="cscript.exe"
-  OR process_file_name="searchprotocolhost.exe" OR process_file_name="microsoft.workflow.compiler.exe"
-  OR process_file_name="msbuild.exe" OR process_file_name="colorcpl.exe" OR process_file_name="scrcons.exe"
-  OR process_file_name="cmd.exe" OR process_file_name="powershell.exe") AND like(actor_process_file_name,
-  "%mshta.exe") --finding_report--'
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
+  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
+  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
+  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
+  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
+  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
+  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
+  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
+  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
+  (process_file_name="wscript.exe" OR process_file_name="cscript.exe" OR process_file_name="searchprotocolhost.exe"
+  OR process_file_name="microsoft.workflow.compiler.exe" OR process_file_name="msbuild.exe"
+  OR process_file_name="colorcpl.exe" OR process_file_name="scrcons.exe" OR process_file_name="cmd.exe"
+  OR process_file_name="powershell.exe") AND like(actor_process_file_name, "%mshta.exe")
+  --finding_report--'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -77,6 +79,8 @@ tags:
   mappings:
   - ocsf: process.pid
     cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
   - ocsf: process.file.name
     cim: process_name
   - ocsf: process.cmd_line
@@ -85,6 +89,8 @@ tags:
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
   - ocsf: actor.process.file.name
     cim: parent_process_name
   - ocsf: device.hostname
diff --git a/ssa_detections/endpoint/ssa___windows_mshta_command_line_url.yml b/ssa_detections/endpoint/ssa___windows_mshta_command_line_url.yml
index 8f0128674c..baf840909c 100644
--- a/ssa_detections/endpoint/ssa___windows_mshta_command_line_url.yml
+++ b/ssa_detections/endpoint/ssa___windows_mshta_command_line_url.yml
@@ -19,18 +19,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
   process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
   "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
-  any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
-  null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
-  | eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
-  process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
-  "map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
-  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
-  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
-  any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
-  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
-  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where (like(process_cmd_line, "%https://%") OR like(process_cmd_line, "%http://%"))
-  AND process_file_name="mshta.exe" --finding_report--'
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
+  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
+  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
+  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
+  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
+  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
+  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
+  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
+  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
+  (like(process_cmd_line, "%https://%") OR like(process_cmd_line, "%http://%")) AND
+  process_file_name="mshta.exe" --finding_report--'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
@@ -76,6 +78,8 @@ tags:
   mappings:
   - ocsf: process.pid
     cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
   - ocsf: process.file.name
     cim: process_name
   - ocsf: process.cmd_line
@@ -84,6 +88,8 @@ tags:
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
   - ocsf: actor.process.file.name
     cim: parent_process_name
   - ocsf: device.hostname
diff --git a/ssa_detections/endpoint/ssa___windows_mshta_inline_hta_execution.yml b/ssa_detections/endpoint/ssa___windows_mshta_inline_hta_execution.yml
index 2b00157d51..4f5b7107ef 100644
--- a/ssa_detections/endpoint/ssa___windows_mshta_inline_hta_execution.yml
+++ b/ssa_detections/endpoint/ssa___windows_mshta_inline_hta_execution.yml
@@ -17,18 +17,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
   process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
   "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
-  any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
-  null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
-  | eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
-  process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
-  "map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
-  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
-  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
-  any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
-  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
-  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where (like(process_cmd_line, "%about%") OR like(process_cmd_line, "%javascript%")
-  OR like(process_cmd_line, "%vbscript%")) AND process_file_name="mshta.exe" --finding_report--'
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
+  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
+  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
+  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
+  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
+  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
+  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
+  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
+  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
+  (like(process_cmd_line, "%about%") OR like(process_cmd_line, "%javascript%") OR
+  like(process_cmd_line, "%vbscript%")) AND process_file_name="mshta.exe" --finding_report--'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
@@ -74,6 +76,8 @@ tags:
   mappings:
   - ocsf: process.pid
     cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
   - ocsf: process.file.name
     cim: process_name
   - ocsf: process.cmd_line
@@ -82,6 +86,8 @@ tags:
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
   - ocsf: actor.process.file.name
     cim: parent_process_name
   - ocsf: device.hostname
diff --git a/ssa_detections/endpoint/ssa___windows_odbcconf_load_response_file.yml b/ssa_detections/endpoint/ssa___windows_odbcconf_load_response_file.yml
index 03e509bd15..9a36180506 100644
--- a/ssa_detections/endpoint/ssa___windows_odbcconf_load_response_file.yml
+++ b/ssa_detections/endpoint/ssa___windows_odbcconf_load_response_file.yml
@@ -17,18 +17,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
   process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
   "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
-  any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
-  null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
-  | eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
-  process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
-  "map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
-  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
-  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
-  any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
-  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
-  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where ((like(process_cmd_line, "%/f %") OR like(process_cmd_line, "%-f %"))
-  AND process_file_name="odbcconf.exe") AND like(process_cmd_line, "%.rsp%") --finding_report--'
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
+  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
+  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
+  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
+  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
+  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
+  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
+  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
+  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
+  ((like(process_cmd_line, "%/f %") OR like(process_cmd_line, "%-f %")) AND process_file_name="odbcconf.exe")
+  AND like(process_cmd_line, "%.rsp%") --finding_report--'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -70,6 +72,8 @@ tags:
   mappings:
   - ocsf: process.pid
     cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
   - ocsf: process.file.name
     cim: process_name
   - ocsf: process.cmd_line
@@ -78,6 +82,8 @@ tags:
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
   - ocsf: actor.process.file.name
     cim: parent_process_name
   - ocsf: device.hostname
diff --git a/ssa_detections/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml b/ssa_detections/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml
index d31ec7493c..2f60612ab6 100644
--- a/ssa_detections/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml
+++ b/ssa_detections/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml
@@ -23,18 +23,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
   process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
   "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
-  any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
-  null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
-  | eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
-  process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
-  "map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
-  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
-  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
-  any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
-  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
-  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where process_file_name="ntdsutil.exe" AND (like(process_cmd_line, "%create%")
-  AND like(process_cmd_line, "%ntds%")) --finding_report--'
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
+  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
+  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
+  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
+  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
+  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
+  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
+  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
+  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
+  process_file_name="ntdsutil.exe" AND (like(process_cmd_line, "%create%") AND like(process_cmd_line,
+  "%ntds%")) --finding_report--'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -80,6 +82,8 @@ tags:
   mappings:
   - ocsf: process.pid
     cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
   - ocsf: process.file.name
     cim: process_name
   - ocsf: process.cmd_line
@@ -88,6 +92,8 @@ tags:
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
   - ocsf: actor.process.file.name
     cim: parent_process_name
   - ocsf: device.hostname
diff --git a/ssa_detections/endpoint/ssa___windows_os_credential_dumping_with_procdump.yml b/ssa_detections/endpoint/ssa___windows_os_credential_dumping_with_procdump.yml
index 07bdf4fdd2..7ca5eca460 100644
--- a/ssa_detections/endpoint/ssa___windows_os_credential_dumping_with_procdump.yml
+++ b/ssa_detections/endpoint/ssa___windows_os_credential_dumping_with_procdump.yml
@@ -22,19 +22,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
   process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
   "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
-  any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
-  null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
-  | eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
-  process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
-  "map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
-  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
-  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
-  any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
-  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
-  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where ((like(process_cmd_line, "%-ma %") OR like(process_cmd_line, "%-mm
-  %")) AND (process_file_name="procdump64.exe" OR process_file_name="procdump.exe"))
-  AND like(process_cmd_line, "%lsass%") --finding_report--'
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
+  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
+  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
+  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
+  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
+  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
+  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
+  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
+  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
+  ((like(process_cmd_line, "%-ma %") OR like(process_cmd_line, "%-mm %")) AND (process_file_name="procdump64.exe"
+  OR process_file_name="procdump.exe")) AND like(process_cmd_line, "%lsass%") --finding_report--'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -77,6 +78,8 @@ tags:
   mappings:
   - ocsf: process.pid
     cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
   - ocsf: process.file.name
     cim: process_name
   - ocsf: process.cmd_line
@@ -85,6 +88,8 @@ tags:
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
   - ocsf: actor.process.file.name
     cim: parent_process_name
   - ocsf: device.hostname
diff --git a/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml
index bd6f3f1e8f..4c0cf33a2c 100644
--- a/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml
+++ b/ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml
@@ -21,18 +21,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
   process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
   "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
-  any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
-  null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
-  | eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
-  process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
-  "map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
-  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
-  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
-  any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
-  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
-  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe"
-  OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe"
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
+  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
+  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
+  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
+  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
+  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
+  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
+  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
+  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
+  (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe" OR
+  process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe"
   OR process_file_name="pwsh.exe") AND (NOT match_regex(process_cmd_line, /(?i)(?i)[\\-|\\/]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]/)=true)
   --finding_report--'
 how_to_implement: You must be ingesting data that records process activity from your
@@ -83,6 +85,8 @@ tags:
   mappings:
   - ocsf: process.pid
     cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
   - ocsf: process.file.name
     cim: process_name
   - ocsf: process.cmd_line
@@ -91,6 +95,8 @@ tags:
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
   - ocsf: actor.process.file.name
     cim: parent_process_name
   - ocsf: device.hostname
diff --git a/ssa_detections/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml b/ssa_detections/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml
index 9cdb0d24bf..6ddde6d0a0 100644
--- a/ssa_detections/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml
+++ b/ssa_detections/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml
@@ -20,18 +20,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
   process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
   "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
-  any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
-  null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
-  | eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
-  process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
-  "map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
-  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
-  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
-  any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
-  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
-  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where like(process_cmd_line, "%4194304%") AND match_regex(process_cmd_line,
-  /(?i)get-aduser/)=true --finding_report--'
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
+  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
+  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
+  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
+  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
+  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
+  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
+  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
+  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
+  like(process_cmd_line, "%4194304%") AND match_regex(process_cmd_line, /(?i)get-aduser/)=true
+  --finding_report--'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
   https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
@@ -69,6 +71,8 @@ tags:
   mappings:
   - ocsf: process.pid
     cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
   - ocsf: process.file.name
     cim: process_name
   - ocsf: process.cmd_line
@@ -77,6 +81,8 @@ tags:
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
   - ocsf: actor.process.file.name
     cim: parent_process_name
   - ocsf: device.hostname
diff --git a/ssa_detections/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml b/ssa_detections/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml
index 0b3d7e0d62..05fd9c657f 100644
--- a/ssa_detections/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml
+++ b/ssa_detections/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml
@@ -20,17 +20,19 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
   process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
   "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
-  any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
-  null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
-  | eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
-  process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
-  "map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
-  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
-  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
-  any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
-  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
-  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where match_regex(process_cmd_line, /(?i)preauthnotrequired/)=true AND match_regex(process_cmd_line,
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
+  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
+  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
+  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
+  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
+  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
+  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
+  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
+  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
+  match_regex(process_cmd_line, /(?i)preauthnotrequired/)=true AND match_regex(process_cmd_line,
   /(?i)get-domainuser/)=true --finding_report--'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -68,6 +70,8 @@ tags:
   mappings:
   - ocsf: process.pid
     cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
   - ocsf: process.file.name
     cim: process_name
   - ocsf: process.cmd_line
@@ -76,6 +80,8 @@ tags:
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
   - ocsf: actor.process.file.name
     cim: parent_process_name
   - ocsf: device.hostname
diff --git a/ssa_detections/endpoint/ssa___windows_powershell_downloadfile.yml b/ssa_detections/endpoint/ssa___windows_powershell_downloadfile.yml
index d2998e08be..197ab0f14e 100644
--- a/ssa_detections/endpoint/ssa___windows_powershell_downloadfile.yml
+++ b/ssa_detections/endpoint/ssa___windows_powershell_downloadfile.yml
@@ -17,18 +17,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
   process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
   "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
-  any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
-  null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
-  | eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
-  process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
-  "map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
-  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
-  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
-  any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
-  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
-  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe"
-  OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe"
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
+  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
+  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
+  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
+  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
+  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
+  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
+  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
+  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
+  (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe" OR
+  process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe"
   OR process_file_name="pwsh.exe") AND match_regex(process_cmd_line, /(?i)downloadfile/)=true
   --finding_report--'
 how_to_implement: To successfully implement this search you need to be ingesting information
@@ -77,6 +79,8 @@ tags:
   mappings:
   - ocsf: process.pid
     cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
   - ocsf: process.file.name
     cim: process_name
   - ocsf: process.cmd_line
@@ -85,6 +89,8 @@ tags:
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
   - ocsf: actor.process.file.name
     cim: parent_process_name
   - ocsf: device.hostname
diff --git a/ssa_detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml b/ssa_detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml
index a5287eef0c..35dad0242a 100644
--- a/ssa_detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml
+++ b/ssa_detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml
@@ -19,18 +19,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
   process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
   "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
-  any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
-  null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
-  | eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
-  process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
-  "map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
-  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
-  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
-  any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
-  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
-  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe"
-  OR process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe"
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
+  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
+  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
+  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
+  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
+  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
+  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
+  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
+  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
+  (process_file_name="powershell_ise.exe" OR process_file_name="powershell.exe" OR
+  process_file_name="sqltoolsps.exe" OR process_file_name="sqlps.exe" OR process_file_name="pwsh.exe"
   OR process_file_name="pwsh.exe") AND match_regex(process_cmd_line, /(?i)start-bitstransfer/)=true
   --finding_report--'
 how_to_implement: To successfully implement this search you need to be ingesting information
@@ -75,6 +77,8 @@ tags:
   mappings:
   - ocsf: process.pid
     cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
   - ocsf: process.file.name
     cim: process_name
   - ocsf: process.cmd_line
@@ -83,6 +87,8 @@ tags:
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
   - ocsf: actor.process.file.name
     cim: parent_process_name
   - ocsf: device.hostname
diff --git a/ssa_detections/endpoint/ssa___windows_rasautou_dll_execution.yml b/ssa_detections/endpoint/ssa___windows_rasautou_dll_execution.yml
index e7bdc1330b..96274f8a1c 100644
--- a/ssa_detections/endpoint/ssa___windows_rasautou_dll_execution.yml
+++ b/ssa_detections/endpoint/ssa___windows_rasautou_dll_execution.yml
@@ -16,18 +16,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
   process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
   "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
-  any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
-  null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
-  | eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
-  process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
-  "map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
-  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
-  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
-  any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
-  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
-  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where process_file_name="rasautou.exe" AND match_regex(process_cmd_line,
-  /(?i)-p /)=true AND match_regex(process_cmd_line, /(?i)-d /)=true --finding_report--'
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
+  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
+  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
+  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
+  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
+  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
+  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
+  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
+  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
+  process_file_name="rasautou.exe" AND match_regex(process_cmd_line, /(?i)-p /)=true
+  AND match_regex(process_cmd_line, /(?i)-d /)=true --finding_report--'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
@@ -74,6 +76,8 @@ tags:
   mappings:
   - ocsf: process.pid
     cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
   - ocsf: process.file.name
     cim: process_name
   - ocsf: process.cmd_line
@@ -82,6 +86,8 @@ tags:
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
   - ocsf: actor.process.file.name
     cim: parent_process_name
   - ocsf: device.hostname
diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml
index 1b1d93bec2..80686c2a48 100644
--- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml
+++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml
@@ -16,17 +16,19 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
   process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
   "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
-  any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
-  null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
-  | eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
-  process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
-  "map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
-  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
-  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
-  any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
-  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
-  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where process_file_name="acccheckconsole.exe" AND (NOT match_regex(process_path,
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
+  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
+  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
+  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
+  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
+  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
+  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
+  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
+  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
+  process_file_name="acccheckconsole.exe" AND (NOT match_regex(process_file_path,
   /(?i)\\program files (x86)\\windows kits\\10\\bin\\10.0.22000.0\\arm64\\accchecker/)=true)
   --finding_report--'
 how_to_implement: To successfully implement this search, you must be ingesting logs
@@ -56,6 +58,8 @@ tags:
     type: User Name
   - name: device.hostname
     type: Hostname
+  - name: process.file.path
+    type: File
   - name: process.file.name
     type: File Name
   - name: process.cmd_line
@@ -65,6 +69,7 @@ tags:
   required_fields:
   - process.user.name
   - device.hostname
+  - process.file.path
   - process.file.name
   - process.cmd_line
   risk_score: 14
@@ -72,6 +77,8 @@ tags:
   mappings:
   - ocsf: process.pid
     cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
   - ocsf: process.file.name
     cim: process_name
   - ocsf: process.cmd_line
@@ -80,6 +87,8 @@ tags:
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
   - ocsf: actor.process.file.name
     cim: parent_process_name
   - ocsf: device.hostname
diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml
index 5c1c37da13..5c1ef56ff5 100644
--- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml
+++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml
@@ -16,18 +16,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
   process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
   "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
-  any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
-  null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
-  | eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
-  process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
-  "map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
-  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
-  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
-  any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
-  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
-  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where process_file_name="adplus.exe" AND (NOT match_regex(process_path,
-  /(?i)\\program files (x86)\\windows kits\\10\\debuggers\\x86/)=true) --finding_report--'
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
+  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
+  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
+  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
+  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
+  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
+  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
+  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
+  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
+  process_file_name="adplus.exe" AND (NOT match_regex(process_file_path, /(?i)\\program
+  files (x86)\\windows kits\\10\\debuggers\\x86/)=true) --finding_report--'
 how_to_implement: To successfully implement this search, you must be ingesting logs
   with the process name, command-line arguments, and parent processes from your endpoints.
   Collect endpoint data such as Sysmon or Windows Events 4688.
@@ -55,6 +57,8 @@ tags:
     type: User Name
   - name: device.hostname
     type: Hostname
+  - name: process.file.path
+    type: File
   - name: process.file.name
     type: File Name
   - name: process.cmd_line
@@ -64,6 +68,7 @@ tags:
   required_fields:
   - process.user.name
   - device.hostname
+  - process.file.path
   - process.file.name
   - process.cmd_line
   risk_score: 14
@@ -71,6 +76,8 @@ tags:
   mappings:
   - ocsf: process.pid
     cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
   - ocsf: process.file.name
     cim: process_name
   - ocsf: process.cmd_line
@@ -79,6 +86,8 @@ tags:
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
   - ocsf: actor.process.file.name
     cim: parent_process_name
   - ocsf: device.hostname
diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml
index b7b4fa64d3..7e7573de39 100644
--- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml
+++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml
@@ -16,18 +16,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
   process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
   "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
-  any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
-  null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
-  | eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
-  process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
-  "map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
-  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
-  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
-  any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
-  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
-  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where process_file_name="advpack.dll" AND (NOT match_regex(process_path,
-  /(?i)\\windows\\syswow64/)=true) --finding_report--'
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
+  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
+  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
+  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
+  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
+  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
+  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
+  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
+  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
+  process_file_name="advpack.dll" AND (NOT match_regex(process_file_path, /(?i)\\windows\\syswow64/)=true)
+  --finding_report--'
 how_to_implement: To successfully implement this search, you must be ingesting logs
   with the process name, command-line arguments, and parent processes from your endpoints.
   Collect endpoint data such as Sysmon or Windows Events 4688.
@@ -55,6 +57,8 @@ tags:
     type: User Name
   - name: device.hostname
     type: Hostname
+  - name: process.file.path
+    type: File
   - name: process.file.name
     type: File Name
   - name: process.cmd_line
@@ -64,6 +68,7 @@ tags:
   required_fields:
   - process.user.name
   - device.hostname
+  - process.file.path
   - process.file.name
   - process.cmd_line
   risk_score: 14
@@ -71,6 +76,8 @@ tags:
   mappings:
   - ocsf: process.pid
     cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
   - ocsf: process.file.name
     cim: process_name
   - ocsf: process.cmd_line
@@ -79,6 +86,8 @@ tags:
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
   - ocsf: actor.process.file.name
     cim: parent_process_name
   - ocsf: device.hostname
diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml
index 012104c9a1..e60df0e1b2 100644
--- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml
+++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml
@@ -16,18 +16,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
   process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
   "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
-  any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
-  null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
-  | eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
-  process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
-  "map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
-  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
-  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
-  any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
-  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
-  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where process_file_name="agentexecutor.exe" AND (NOT match_regex(process_path,
-  /(?i)\\program files (x86)/)=true) --finding_report--'
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
+  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
+  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
+  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
+  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
+  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
+  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
+  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
+  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
+  process_file_name="agentexecutor.exe" AND (NOT match_regex(process_file_path, /(?i)\\program
+  files (x86)/)=true) --finding_report--'
 how_to_implement: To successfully implement this search, you must be ingesting logs
   with the process name, command-line arguments, and parent processes from your endpoints.
   Collect endpoint data such as Sysmon or Windows Events 4688.
@@ -55,6 +57,8 @@ tags:
     type: User Name
   - name: device.hostname
     type: Hostname
+  - name: process.file.path
+    type: File
   - name: process.file.name
     type: File Name
   - name: process.cmd_line
@@ -64,6 +68,7 @@ tags:
   required_fields:
   - process.user.name
   - device.hostname
+  - process.file.path
   - process.file.name
   - process.cmd_line
   risk_score: 14
@@ -71,6 +76,8 @@ tags:
   mappings:
   - ocsf: process.pid
     cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
   - ocsf: process.file.name
     cim: process_name
   - ocsf: process.cmd_line
@@ -79,6 +86,8 @@ tags:
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
   - ocsf: actor.process.file.name
     cim: parent_process_name
   - ocsf: device.hostname
diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml
index c2a7683e3d..488fc3d360 100644
--- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml
+++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml
@@ -16,18 +16,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
   process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
   "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
-  any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
-  null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
-  | eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
-  process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
-  "map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
-  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
-  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
-  any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
-  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
-  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where process_file_name="appinstaller.exe" AND (NOT match_regex(process_path,
-  /(?i)\\program files\\windowsapps\\microsoft.desktopappinstaller_1.11.2521.0_x64__8wekyb3d8bbwe/)=true)
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
+  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
+  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
+  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
+  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
+  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
+  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
+  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
+  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
+  process_file_name="appinstaller.exe" AND (NOT match_regex(process_file_path, /(?i)\\program
+  files\\windowsapps\\microsoft.desktopappinstaller_1.11.2521.0_x64__8wekyb3d8bbwe/)=true)
   --finding_report--'
 how_to_implement: To successfully implement this search, you must be ingesting logs
   with the process name, command-line arguments, and parent processes from your endpoints.
@@ -56,6 +58,8 @@ tags:
     type: User Name
   - name: device.hostname
     type: Hostname
+  - name: process.file.path
+    type: File
   - name: process.file.name
     type: File Name
   - name: process.cmd_line
@@ -65,6 +69,7 @@ tags:
   required_fields:
   - process.user.name
   - device.hostname
+  - process.file.path
   - process.file.name
   - process.cmd_line
   risk_score: 14
@@ -72,6 +77,8 @@ tags:
   mappings:
   - ocsf: process.pid
     cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
   - ocsf: process.file.name
     cim: process_name
   - ocsf: process.cmd_line
@@ -80,6 +87,8 @@ tags:
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
   - ocsf: actor.process.file.name
     cim: parent_process_name
   - ocsf: device.hostname
diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml
index 53a078edd3..24a38ca3b1 100644
--- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml
+++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml
@@ -16,18 +16,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
   process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
   "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
-  any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
-  null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
-  | eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
-  process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
-  "map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
-  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
-  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
-  any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
-  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
-  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where process_file_name="appvlp.exe" AND (NOT match_regex(process_path,
-  /(?i)\\program files (x86)\\microsoft office\\root\\client/)=true) --finding_report--'
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
+  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
+  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
+  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
+  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
+  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
+  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
+  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
+  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
+  process_file_name="appvlp.exe" AND (NOT match_regex(process_file_path, /(?i)\\program
+  files (x86)\\microsoft office\\root\\client/)=true) --finding_report--'
 how_to_implement: To successfully implement this search, you must be ingesting logs
   with the process name, command-line arguments, and parent processes from your endpoints.
   Collect endpoint data such as Sysmon or Windows Events 4688.
@@ -55,6 +57,8 @@ tags:
     type: User Name
   - name: device.hostname
     type: Hostname
+  - name: process.file.path
+    type: File
   - name: process.file.name
     type: File Name
   - name: process.cmd_line
@@ -64,6 +68,7 @@ tags:
   required_fields:
   - process.user.name
   - device.hostname
+  - process.file.path
   - process.file.name
   - process.cmd_line
   risk_score: 14
@@ -71,6 +76,8 @@ tags:
   mappings:
   - ocsf: process.pid
     cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
   - ocsf: process.file.name
     cim: process_name
   - ocsf: process.cmd_line
@@ -79,6 +86,8 @@ tags:
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
   - ocsf: actor.process.file.name
     cim: parent_process_name
   - ocsf: device.hostname
diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml
index 30bb4297ad..f6f462f62e 100644
--- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml
+++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml
@@ -16,17 +16,19 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
   process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
   "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
-  any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
-  null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
-  | eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
-  process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
-  "map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
-  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
-  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
-  any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
-  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
-  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where process_file_name="aspnet_compiler.exe" AND (NOT match_regex(process_path,
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
+  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
+  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
+  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
+  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
+  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
+  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
+  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
+  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
+  process_file_name="aspnet_compiler.exe" AND (NOT match_regex(process_file_path,
   /(?i)\\windows\\microsoft.net\\framework64\\v4.0.30319/)=true) --finding_report--'
 how_to_implement: To successfully implement this search, you must be ingesting logs
   with the process name, command-line arguments, and parent processes from your endpoints.
@@ -55,6 +57,8 @@ tags:
     type: User Name
   - name: device.hostname
     type: Hostname
+  - name: process.file.path
+    type: File
   - name: process.file.name
     type: File Name
   - name: process.cmd_line
@@ -64,6 +68,7 @@ tags:
   required_fields:
   - process.user.name
   - device.hostname
+  - process.file.path
   - process.file.name
   - process.cmd_line
   risk_score: 14
@@ -71,6 +76,8 @@ tags:
   mappings:
   - ocsf: process.pid
     cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
   - ocsf: process.file.name
     cim: process_name
   - ocsf: process.cmd_line
@@ -79,6 +86,8 @@ tags:
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
   - ocsf: actor.process.file.name
     cim: parent_process_name
   - ocsf: device.hostname
diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml
index cc765d2ea8..21ebca69af 100644
--- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml
+++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml
@@ -16,17 +16,19 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
   process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
   "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
-  any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
-  null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
-  | eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
-  process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
-  "map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
-  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
-  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
-  any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
-  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
-  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where process_file_name="at.exe" AND (NOT match_regex(process_path, /(?i)\\windows\\syswow64/)=true)
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
+  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
+  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
+  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
+  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
+  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
+  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
+  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
+  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
+  process_file_name="at.exe" AND (NOT match_regex(process_file_path, /(?i)\\windows\\syswow64/)=true)
   --finding_report--'
 how_to_implement: To successfully implement this search, you must be ingesting logs
   with the process name, command-line arguments, and parent processes from your endpoints.
@@ -55,6 +57,8 @@ tags:
     type: User Name
   - name: device.hostname
     type: Hostname
+  - name: process.file.path
+    type: File
   - name: process.file.name
     type: File Name
   - name: process.cmd_line
@@ -64,6 +68,7 @@ tags:
   required_fields:
   - process.user.name
   - device.hostname
+  - process.file.path
   - process.file.name
   - process.cmd_line
   risk_score: 14
@@ -71,6 +76,8 @@ tags:
   mappings:
   - ocsf: process.pid
     cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
   - ocsf: process.file.name
     cim: process_name
   - ocsf: process.cmd_line
@@ -79,6 +86,8 @@ tags:
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
   - ocsf: actor.process.file.name
     cim: parent_process_name
   - ocsf: device.hostname
diff --git a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml
index a2288b50c5..65ee3ca7f8 100644
--- a/ssa_detections/endpoint/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml
+++ b/ssa_detections/endpoint/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml
@@ -16,18 +16,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
   process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
   "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
-  any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
-  null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
-  | eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
-  process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
-  "map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
-  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
-  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
-  any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
-  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
-  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where process_file_name="atbroker.exe" AND (NOT match_regex(process_path,
-  /(?i)\\windows\\syswow64/)=true) --finding_report--'
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
+  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
+  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
+  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
+  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
+  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
+  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
+  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
+  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
+  process_file_name="atbroker.exe" AND (NOT match_regex(process_file_path, /(?i)\\windows\\syswow64/)=true)
+  --finding_report--'
 how_to_implement: To successfully implement this search, you must be ingesting logs
   with the process name, command-line arguments, and parent processes from your endpoints.
   Collect endpoint data such as Sysmon or Windows Events 4688.
@@ -55,6 +57,8 @@ tags:
     type: User Name
   - name: device.hostname
     type: Hostname
+  - name: process.file.path
+    type: File
   - name: process.file.name
     type: File Name
   - name: process.cmd_line
@@ -64,6 +68,7 @@ tags:
   required_fields:
   - process.user.name
   - device.hostname
+  - process.file.path
   - process.file.name
   - process.cmd_line
   risk_score: 14
@@ -71,6 +76,8 @@ tags:
   mappings:
   - ocsf: process.pid
     cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
   - ocsf: process.file.name
     cim: process_name
   - ocsf: process.cmd_line
@@ -79,6 +86,8 @@ tags:
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
   - ocsf: actor.process.file.name
     cim: parent_process_name
   - ocsf: device.hostname
diff --git a/ssa_detections/endpoint/ssa___windows_rundll32_comsvcs_memory_dump.yml b/ssa_detections/endpoint/ssa___windows_rundll32_comsvcs_memory_dump.yml
index 62dc1a8cf3..3142d45cdb 100644
--- a/ssa_detections/endpoint/ssa___windows_rundll32_comsvcs_memory_dump.yml
+++ b/ssa_detections/endpoint/ssa___windows_rundll32_comsvcs_memory_dump.yml
@@ -15,17 +15,19 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
   process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
   "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
-  any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
-  null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
-  | eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
-  process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
-  "map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
-  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
-  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
-  any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
-  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
-  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where (match_regex(process_cmd_line, /(?i)minidump/)=true AND process_file_name="rundll32.exe")
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
+  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
+  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
+  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
+  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
+  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
+  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
+  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
+  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
+  (match_regex(process_cmd_line, /(?i)minidump/)=true AND process_file_name="rundll32.exe")
   AND match_regex(process_cmd_line, /(?i)comsvcs.dll/)=true --finding_report--'
 how_to_implement: You must be ingesting endpoint data that tracks process activity,
   including Windows command line logging. You can see how we test this with [Event
@@ -68,6 +70,8 @@ tags:
   mappings:
   - ocsf: process.pid
     cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
   - ocsf: process.file.name
     cim: process_name
   - ocsf: process.cmd_line
@@ -76,6 +80,8 @@ tags:
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
   - ocsf: actor.process.file.name
     cim: parent_process_name
   - ocsf: device.hostname
diff --git a/ssa_detections/endpoint/ssa___windows_rundll32_inline_hta_execution.yml b/ssa_detections/endpoint/ssa___windows_rundll32_inline_hta_execution.yml
index 380b916bc7..95e14ee82e 100644
--- a/ssa_detections/endpoint/ssa___windows_rundll32_inline_hta_execution.yml
+++ b/ssa_detections/endpoint/ssa___windows_rundll32_inline_hta_execution.yml
@@ -19,18 +19,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
   process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
   "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
-  any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
-  null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
-  | eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
-  process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
-  "map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
-  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
-  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
-  any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
-  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
-  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where (like(process_cmd_line, "%about%") OR like(process_cmd_line, "%javascript%")
-  OR like(process_cmd_line, "%vbscript%")) AND process_file_name="rundll32.exe" --finding_report--'
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
+  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
+  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
+  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
+  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
+  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
+  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
+  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
+  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
+  (like(process_cmd_line, "%about%") OR like(process_cmd_line, "%javascript%") OR
+  like(process_cmd_line, "%vbscript%")) AND process_file_name="rundll32.exe" --finding_report--'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
@@ -75,6 +77,8 @@ tags:
   mappings:
   - ocsf: process.pid
     cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
   - ocsf: process.file.name
     cim: process_name
   - ocsf: process.cmd_line
@@ -83,6 +87,8 @@ tags:
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
   - ocsf: actor.process.file.name
     cim: parent_process_name
   - ocsf: device.hostname
diff --git a/ssa_detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml b/ssa_detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml
index 95a9c5e791..d4a9694e7d 100644
--- a/ssa_detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml
+++ b/ssa_detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml
@@ -18,19 +18,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
   process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
   "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
-  any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
-  null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
-  | eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
-  process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
-  "map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
-  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
-  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
-  any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
-  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
-  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where process_file_name="MSBuild.exe" AND (match_regex(actor_process_file_name,
-  /(?i)cscript.exe/)=true OR match_regex(actor_process_file_name, /(?i)wscript.exe/)=true)
-  --finding_report--'
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
+  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
+  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
+  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
+  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
+  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
+  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
+  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
+  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
+  process_file_name="MSBuild.exe" AND (match_regex(actor_process_file_name, /(?i)cscript.exe/)=true
+  OR match_regex(actor_process_file_name, /(?i)wscript.exe/)=true) --finding_report--'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
@@ -77,6 +78,8 @@ tags:
   mappings:
   - ocsf: process.pid
     cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
   - ocsf: process.file.name
     cim: process_name
   - ocsf: process.cmd_line
@@ -85,6 +88,8 @@ tags:
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
   - ocsf: actor.process.file.name
     cim: parent_process_name
   - ocsf: device.hostname
diff --git a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml
index bd8159a9d7..7d4ca946b7 100644
--- a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml
+++ b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml
@@ -18,18 +18,19 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
   process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
   "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
-  any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
-  null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
-  | eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
-  process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
-  "map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
-  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
-  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
-  any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
-  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
-  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where like(process_cmd_line, "%-decompile%") AND process_file_name="hh.exe"
-  --finding_report--'
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
+  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
+  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
+  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
+  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
+  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
+  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
+  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
+  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
+  like(process_cmd_line, "%-decompile%") AND process_file_name="hh.exe" --finding_report--'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -73,6 +74,8 @@ tags:
   mappings:
   - ocsf: process.pid
     cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
   - ocsf: process.file.name
     cim: process_name
   - ocsf: process.cmd_line
@@ -81,6 +84,8 @@ tags:
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
   - ocsf: actor.process.file.name
     cim: parent_process_name
   - ocsf: device.hostname
diff --git a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml
index e428b782a4..073d980790 100644
--- a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml
+++ b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml
@@ -23,18 +23,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
   process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
   "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
-  any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
-  null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
-  | eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
-  process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
-  "map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
-  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
-  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
-  any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
-  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
-  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where (like(process_cmd_line, "%https://%") OR like(process_cmd_line, "%http://%"))
-  AND process_file_name="hh.exe" --finding_report--'
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
+  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
+  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
+  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
+  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
+  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
+  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
+  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
+  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
+  (like(process_cmd_line, "%https://%") OR like(process_cmd_line, "%http://%")) AND
+  process_file_name="hh.exe" --finding_report--'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -81,6 +83,8 @@ tags:
   mappings:
   - ocsf: process.pid
     cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
   - ocsf: process.file.name
     cim: process_name
   - ocsf: process.cmd_line
@@ -89,6 +93,8 @@ tags:
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
   - ocsf: actor.process.file.name
     cim: parent_process_name
   - ocsf: device.hostname
diff --git a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml
index 64595d403f..e437580929 100644
--- a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml
+++ b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml
@@ -26,18 +26,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
   process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
   "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
-  any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
-  null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
-  | eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
-  process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
-  "map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
-  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
-  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
-  any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
-  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
-  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where (like(process_cmd_line, "%mk:@MSITStore:%") OR like(process_cmd_line,
-  "%its:%")) AND process_file_name="hh.exe" --finding_report--'
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
+  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
+  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
+  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
+  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
+  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
+  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
+  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
+  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
+  (like(process_cmd_line, "%mk:@MSITStore:%") OR like(process_cmd_line, "%its:%"))
+  AND process_file_name="hh.exe" --finding_report--'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -84,6 +86,8 @@ tags:
   mappings:
   - ocsf: process.pid
     cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
   - ocsf: process.file.name
     cim: process_name
   - ocsf: process.cmd_line
@@ -92,6 +96,8 @@ tags:
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
   - ocsf: actor.process.file.name
     cim: parent_process_name
   - ocsf: device.hostname
diff --git a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml
index e8da08c578..19bf34db79 100644
--- a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml
+++ b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml
@@ -15,18 +15,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
   process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
   "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
-  any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
-  null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
-  | eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
-  process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
-  "map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
-  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
-  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
-  any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
-  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
-  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where (like(process_cmd_line, "%-y %") OR like(process_cmd_line, "%/y %"))
-  AND process_file_name="msiexec.exe" --finding_report--'
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
+  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
+  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
+  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
+  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
+  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
+  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
+  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
+  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
+  (like(process_cmd_line, "%-y %") OR like(process_cmd_line, "%/y %")) AND process_file_name="msiexec.exe"
+  --finding_report--'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -67,6 +69,8 @@ tags:
   mappings:
   - ocsf: process.pid
     cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
   - ocsf: process.file.name
     cim: process_name
   - ocsf: process.cmd_line
@@ -75,6 +79,8 @@ tags:
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
   - ocsf: actor.process.file.name
     cim: parent_process_name
   - ocsf: device.hostname
diff --git a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml
index 610f3f9edf..b20d4ad619 100644
--- a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml
+++ b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml
@@ -15,18 +15,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
   process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
   "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
-  any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
-  null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
-  | eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
-  process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
-  "map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
-  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
-  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
-  any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
-  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
-  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where (like(process_cmd_line, "%https://%") OR like(process_cmd_line, "%http://%"))
-  AND process_file_name="msiexec.exe" --finding_report--'
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
+  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
+  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
+  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
+  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
+  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
+  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
+  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
+  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
+  (like(process_cmd_line, "%https://%") OR like(process_cmd_line, "%http://%")) AND
+  process_file_name="msiexec.exe" --finding_report--'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -67,6 +69,8 @@ tags:
   mappings:
   - ocsf: process.pid
     cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
   - ocsf: process.file.name
     cim: process_name
   - ocsf: process.cmd_line
@@ -75,6 +79,8 @@ tags:
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
   - ocsf: actor.process.file.name
     cim: parent_process_name
   - ocsf: device.hostname
diff --git a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml
index 7a5f43e2c9..96bbc8a244 100644
--- a/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml
+++ b/ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml
@@ -15,18 +15,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
   process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
   "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
-  any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
-  null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
-  | eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
-  process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
-  "map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
-  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
-  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
-  any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
-  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
-  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where (like(process_cmd_line, "%-z %") OR like(process_cmd_line, "%/z %"))
-  AND process_file_name="msiexec.exe" --finding_report--'
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
+  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
+  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
+  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
+  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
+  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
+  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
+  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
+  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
+  (like(process_cmd_line, "%-z %") OR like(process_cmd_line, "%/z %")) AND process_file_name="msiexec.exe"
+  --finding_report--'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -67,6 +69,8 @@ tags:
   mappings:
   - ocsf: process.pid
     cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
   - ocsf: process.file.name
     cim: process_name
   - ocsf: process.cmd_line
@@ -75,6 +79,8 @@ tags:
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
   - ocsf: actor.process.file.name
     cim: parent_process_name
   - ocsf: device.hostname
diff --git a/ssa_detections/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml b/ssa_detections/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml
index cfc6a238ca..7b1209a8ee 100644
--- a/ssa_detections/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml
+++ b/ssa_detections/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml
@@ -19,18 +19,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
   process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
   "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
-  any>", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string",
-  null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null)
-  | eval process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval
-  process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"),
-  "map<string, any>", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
-  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
-  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
-  any>", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
-  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
-  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where process_file_name="MSBuild.exe" AND match_regex(actor_process_file_name,
-  /(?i)wmiprvse.exe/)=true --finding_report--'
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
+  | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
+  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
+  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
+  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
+  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
+  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
+  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
+  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
+  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
+  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
+  process_file_name="MSBuild.exe" AND match_regex(actor_process_file_name, /(?i)wmiprvse.exe/)=true
+  --finding_report--'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
@@ -77,6 +79,8 @@ tags:
   mappings:
   - ocsf: process.pid
     cim: process_id
+  - ocsf: process.file.path
+    cim: process_path
   - ocsf: process.file.name
     cim: process_name
   - ocsf: process.cmd_line
@@ -85,6 +89,8 @@ tags:
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id
+  - ocsf: actor.process.file.path
+    cim: parent_process_path
   - ocsf: actor.process.file.name
     cim: parent_process_name
   - ocsf: device.hostname