diff --git a/bin/generate.py b/bin/generate.py
index 426432d43d..30abc69d09 100644
--- a/bin/generate.py
+++ b/bin/generate.py
@@ -104,8 +104,11 @@ def generate_ssa_yaml(detections, TEMPLATE_PATH, OUTPUT_PATH):
     # disable yaml pointers https://stackoverflow.com/questions/51272814/python-yaml-dumping-pointer-references
     yaml.Dumper.ignore_aliases = lambda *args : True
 
+    # wiping old detections for SSA
+    shutil.rmtree(OUTPUT_PATH + '/detections/*', ignore_errors=True)
+
     for d in detections:
-        manifest_file = OUTPUT_PATH + '/detections/' + d['name'].lower().replace(" ", "_") + '.yml'
+        manifest_file = OUTPUT_PATH + '/detections/ssa___' + d['name'].lower().replace(" ", "_") + '.yml'
 
         # remove unused fields
         del d['risk']
@@ -113,6 +116,14 @@ def generate_ssa_yaml(detections, TEMPLATE_PATH, OUTPUT_PATH):
         del d['mappings']
         del d['savedsearch_annotations']
 
+        # add detection test
+        test_file = 'ssa___' + d['name'].lower().replace(" ", "_") + '.test.yml'
+        for file in glob.glob('tests/*/*'):
+            if test_file == file.split("/")[-1]:
+                with open(file, 'r') as file:
+                    test_yaml = yaml.safe_load(file)
+                    d['test'] = test_yaml
+
         with open(manifest_file, 'w') as file:
             documents = yaml.dump(d, file, sort_keys=True)
 
@@ -414,7 +425,6 @@ def add_playbook(detection, playbooks):
             if detection['name'] in playbook['tags']['detections']:
                 detection['how_to_implement'] = detection['how_to_implement'] + preface + playbook['name']
         except KeyError:
-            print("playbook " + playbook['name'] + " has no detections, passing....")
             pass
     return detection
 
@@ -664,6 +674,43 @@ def main(REPO_PATH, OUTPUT_PATH, PRODUCT, VERBOSE):
     global global_product
     global_product = PRODUCT
 
+    TEMPLATE_PATH = path.join(REPO_PATH, 'bin/jinja2_templates')
+
+    objects = get_objects(REPO_PATH, OUTPUT_PATH, PRODUCT, VERBOSE)
+
+    try:
+        if VERBOSE:
+            print("generating Mitre lookups")
+    #    generate_mitre_lookup(OUTPUT_PATH)
+    except Exception as e:
+        print('Error: ' + str(e))
+        print("WARNING: Generation of Mitre lookup failed.")
+
+    # calculate deprecation totals
+    deprecated = []
+    for d in objects['detections']:
+        if 'deprecated' in d:
+            deprecated.append(d)
+
+    detection_path = ''
+    lookups_path = ''
+    lookups_files= ''
+    use_case_lib_path = ''
+    macros_path = ''
+    workbench_panels_objects = ''
+
+    if global_product == 'SSA':
+        detection_path = generate_ssa_yaml(objects["detections"], TEMPLATE_PATH, OUTPUT_PATH)
+        objects["macros"] = []
+    else:
+        detection_path = generate_savedsearches_conf(objects["detections"], objects["deployments"], TEMPLATE_PATH, OUTPUT_PATH)
+        lookups_path = generate_transforms_conf(objects["lookups"], TEMPLATE_PATH, OUTPUT_PATH)
+        lookups_path = generate_collections_conf(objects["lookups"], TEMPLATE_PATH, OUTPUT_PATH)
+        lookups_files = generate_lookup_files(objects["lookups"], TEMPLATE_PATH, OUTPUT_PATH,REPO_PATH)
+        use_case_lib_path = generate_use_case_library_conf(objects["stories"], objects["detections"], TEMPLATE_PATH, OUTPUT_PATH)
+        macros_path = generate_macros_conf(objects["macros"], objects["detections"], TEMPLATE_PATH, OUTPUT_PATH)
+        workbench_panels_objects = generate_workbench_panels(objects["detections"], objects["stories"], TEMPLATE_PATH, OUTPUT_PATH)
+
     if global_product == 'API':
         json_types = []
         # List of all YAML types to search in repo
@@ -673,63 +720,25 @@ def main(REPO_PATH, OUTPUT_PATH, PRODUCT, VERBOSE):
         if VERBOSE: print("JSON output directory: " + output_dir)
         # remove any pre-existing output directories
         shutil.rmtree(output_dir, ignore_errors=True)
-        if VERBOSE: print("Remove pre-existing JSON directory")
+        if VERBOSE: print("remove pre-existing JSON directory")
         # create output directory
         os.mkdir(output_dir)
-        if VERBOSE: print("Created output directory")
+        if VERBOSE: print("created output directory")
         # Generate all YAML types
         for yt in yml_types:
             processor = Yaml2Json(yt, REPO_PATH)
             with open(os.path.join(output_dir, yt + '.json'), 'w') as json_out:
                 # write out YAML type
                 json.dump(processor.list_objects(yt), json_out)
-                if VERBOSE: print("Writing %s JSON" % yt)
+                if VERBOSE: print("writing {0} JSON".format(yt))
 
-    else:
-        TEMPLATE_PATH = path.join(REPO_PATH, 'bin/jinja2_templates')
-
-        objects = get_objects(REPO_PATH, OUTPUT_PATH, PRODUCT, VERBOSE)
-
-        try:
-            if VERBOSE:
-                print("generating Mitre lookups")
-        #    generate_mitre_lookup(OUTPUT_PATH)
-        except Exception as e:
-            print('Error: ' + str(e))
-            print("WARNING: Generation of Mitre lookup failed.")
-
-        # calculate deprecation totals
-        deprecated = []
-        for d in objects['detections']:
-            if 'deprecated' in d:
-                deprecated.append(d)
-
-        detection_path = ''
-        lookups_path = ''
-        lookups_files= ''
-        use_case_lib_path = ''
-        macros_path = ''
-        workbench_panels_objects = ''
-
-        if global_product == 'SSA':
-            detection_path = generate_ssa_yaml(objects["detections"], TEMPLATE_PATH, OUTPUT_PATH)
-            objects["macros"] = []
-        else:
-            detection_path = generate_savedsearches_conf(objects["detections"], objects["deployments"], TEMPLATE_PATH, OUTPUT_PATH)
-            lookups_path = generate_transforms_conf(objects["lookups"], TEMPLATE_PATH, OUTPUT_PATH)
-            lookups_path = generate_collections_conf(objects["lookups"], TEMPLATE_PATH, OUTPUT_PATH)
-            lookups_files = generate_lookup_files(objects["lookups"], TEMPLATE_PATH, OUTPUT_PATH,REPO_PATH)
-            use_case_lib_path = generate_use_case_library_conf(objects["stories"], objects["detections"], TEMPLATE_PATH, OUTPUT_PATH)
-            macros_path = generate_macros_conf(objects["macros"], objects["detections"], TEMPLATE_PATH, OUTPUT_PATH)
-            workbench_panels_objects = generate_workbench_panels(objects["detections"], objects["stories"], TEMPLATE_PATH, OUTPUT_PATH)
-
-        if VERBOSE:
-            print("{0} stories have been successfully written to {1}".format(len(objects["stories"]), use_case_lib_path))
-            print("{0} detections have been successfully written to {1}".format(len(objects["detections"]), detection_path))
-            print("{0} detections have been marked deprecated on {1}".format(len(deprecated), detection_path))
-            print("{0} macros have been successfully written to {1}".format(len(objects["macros"]), macros_path))
-            print("{0} workbench panels have been successfully written to {1}, {2} and {3}".format(len(workbench_panels_objects), OUTPUT_PATH + "/default/es_investigations.conf", OUTPUT_PATH + "/default/workflow_actions.conf", OUTPUT_PATH + "/default/data/ui/panels/*"))
-            print("security content generation completed..")
+    if VERBOSE:
+        print("{0} stories have been successfully written to {1}".format(len(objects["stories"]), use_case_lib_path))
+        print("{0} detections have been successfully written to {1}".format(len(objects["detections"]), detection_path))
+        print("{0} detections have been marked deprecated on {1}".format(len(deprecated), detection_path))
+        print("{0} macros have been successfully written to {1}".format(len(objects["macros"]), macros_path))
+        print("{0} workbench panels have been successfully written to {1}, {2} and {3}".format(len(workbench_panels_objects), OUTPUT_PATH + "/default/es_investigations.conf", OUTPUT_PATH + "/default/workflow_actions.conf", OUTPUT_PATH + "/default/data/ui/panels/*"))
+        print("security content generation completed..")
 
 
 if __name__ == "__main__":
diff --git a/dist/ssa/detections/applying_stolen_credentials_via_mimikatz_modules.yml b/dist/ssa/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml
similarity index 83%
rename from dist/ssa/detections/applying_stolen_credentials_via_mimikatz_modules.yml
rename to dist/ssa/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml
index c5c32e9352..15a43f948e 100644
--- a/dist/ssa/detections/applying_stolen_credentials_via_mimikatz_modules.yml
+++ b/dist/ssa/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml
@@ -88,5 +88,16 @@ tags:
   risk_score: 90
   risk_severity: high
   security_domain: endpoint
+test:
+  name: Applying Stolen Credentials via Mimikatz modules - SSA Unit test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllMimikatzModules.log
+      file_name: logAllMimikatzModules.log
+      source: WinEventLog:Security
+    description: Test applying stolen credentials detections
+    file: endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml
+    name: Applying Stolen Credentials via Mimikatz modules
+    pass_condition: '@count_gt(0)'
 type: TTP
 version: 1
diff --git a/dist/ssa/detections/applying_stolen_credentials_via_powersploit_modules.yml b/dist/ssa/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml
similarity index 84%
rename from dist/ssa/detections/applying_stolen_credentials_via_powersploit_modules.yml
rename to dist/ssa/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml
index 3e62dc4873..c8c6a1734d 100644
--- a/dist/ssa/detections/applying_stolen_credentials_via_powersploit_modules.yml
+++ b/dist/ssa/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml
@@ -92,5 +92,16 @@ tags:
   risk_score: 90
   risk_severity: high
   security_domain: endpoint
+test:
+  name: Applying Stolen Credentials via PowerSploit modules - SSA Unit test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555/applying_stolen_credentials/logAllPowerSploitModulesWithOldNames.log
+      file_name: logAllPowerSploitModulesWithOldNames.log
+      source: WinEventLog:Security
+    description: Test applying stolen credentials detections
+    file: endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml
+    name: Applying Stolen Credentials via PowerSploit
+    pass_condition: '@count_gt(0)'
 type: TTP
 version: 1
diff --git a/dist/ssa/detections/assessment_of_credential_strength_via_dsinternals_modules.yml b/dist/ssa/detections/ssa___assessment_of_credential_strength_via_dsinternals_modules.yml
similarity index 100%
rename from dist/ssa/detections/assessment_of_credential_strength_via_dsinternals_modules.yml
rename to dist/ssa/detections/ssa___assessment_of_credential_strength_via_dsinternals_modules.yml
diff --git a/dist/ssa/detections/attempt_to_delete_services.yml b/dist/ssa/detections/ssa___attempt_to_delete_services.yml
similarity index 86%
rename from dist/ssa/detections/attempt_to_delete_services.yml
rename to dist/ssa/detections/ssa___attempt_to_delete_services.yml
index 46b700bafc..a3765f779b 100644
--- a/dist/ssa/detections/attempt_to_delete_services.yml
+++ b/dist/ssa/detections/ssa___attempt_to_delete_services.yml
@@ -12,9 +12,8 @@ how_to_implement: To successfully implement this search, you need to be ingestin
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA. Tune and filter known instances where renamed sc.exe may be used.
 id: a0c8c292-d01a-11eb-aa18-acde48001122
-known_false_positives: It is possible administrative scripts may start/stop/delete
-  services. Filter as needed.
-name: Attempt To Delete Services
+known_false_positives: unknown
+name: Attempt To delete Services
 product:
 - Splunk Behavioral Analytics
 references:
@@ -88,5 +87,16 @@ tags:
   risk_score: 36
   risk_severity: medium
   security_domain: endpoint
+test:
+  name: Attempt To delete Services Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/sc_del.log
+      file_name: sc_del.log
+      source: WinEventLog:Security
+    description: Test for usage of sc.exe to delete a service
+    file: endpoint/ssa___attempt_to_delete_services.yml
+    name: Attempt To delete Services
+    pass_condition: '@count_gt(0)'
 type: TTP
 version: 3
diff --git a/dist/ssa/detections/attempt_to_disable_services.yml b/dist/ssa/detections/ssa___attempt_to_disable_services.yml
similarity index 88%
rename from dist/ssa/detections/attempt_to_disable_services.yml
rename to dist/ssa/detections/ssa___attempt_to_disable_services.yml
index b341e99387..61855c0e35 100644
--- a/dist/ssa/detections/attempt_to_disable_services.yml
+++ b/dist/ssa/detections/ssa___attempt_to_disable_services.yml
@@ -90,5 +90,16 @@ tags:
   risk_score: 36
   risk_severity: medium
   security_domain: endpoint
+test:
+  name: Attempt To Disable Services Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/sc_disable.log
+      file_name: sc_disable.log
+      source: WinEventLog:Security
+    description: Test for usage of sc.exe to disable a service
+    file: endpoint/ssa___attempt_to_disable_services.yml
+    name: Attempt To Disable Services
+    pass_condition: '@count_gt(0)'
 type: TTP
 version: 3
diff --git a/dist/ssa/detections/attempted_credential_dump_from_registry_via_reg_exe.yml b/dist/ssa/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml
similarity index 84%
rename from dist/ssa/detections/attempted_credential_dump_from_registry_via_reg_exe.yml
rename to dist/ssa/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml
index ed95749056..9c8975e21c 100644
--- a/dist/ssa/detections/attempted_credential_dump_from_registry_via_reg_exe.yml
+++ b/dist/ssa/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml
@@ -77,5 +77,16 @@ tags:
   risk_score: 63
   risk_severity: low
   security_domain: endpoint
+test:
+  name: Attempted Credential Dump From Registry via Reg exe - SSA Unit test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-security.log
+      file_name: windows-security.log
+      source: WinEventLog:Security
+    description: Test credential dumping detections
+    file: endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml
+    name: Attempted Credential Dump From Registry via Reg exe
+    pass_condition: '@count_gt(0)'
 type: TTP
 version: 1
diff --git a/dist/ssa/detections/credential_extraction_indicative_of_fgdump_and_cachedump_with_s_option.yml b/dist/ssa/detections/ssa___credential_extraction_indicative_of_fgdump_and_cachedump_with_s_option.yml
similarity index 100%
rename from dist/ssa/detections/credential_extraction_indicative_of_fgdump_and_cachedump_with_s_option.yml
rename to dist/ssa/detections/ssa___credential_extraction_indicative_of_fgdump_and_cachedump_with_s_option.yml
diff --git a/dist/ssa/detections/credential_extraction_indicative_of_fgdump_and_cachedump_with_v_option.yml b/dist/ssa/detections/ssa___credential_extraction_indicative_of_fgdump_and_cachedump_with_v_option.yml
similarity index 100%
rename from dist/ssa/detections/credential_extraction_indicative_of_fgdump_and_cachedump_with_v_option.yml
rename to dist/ssa/detections/ssa___credential_extraction_indicative_of_fgdump_and_cachedump_with_v_option.yml
diff --git a/dist/ssa/detections/credential_extraction_indicative_of_lazagne_command_line_options.yml b/dist/ssa/detections/ssa___credential_extraction_indicative_of_lazagne_command_line_options.yml
similarity index 100%
rename from dist/ssa/detections/credential_extraction_indicative_of_lazagne_command_line_options.yml
rename to dist/ssa/detections/ssa___credential_extraction_indicative_of_lazagne_command_line_options.yml
diff --git a/dist/ssa/detections/credential_extraction_indicative_of_use_of_dsinternals_credential_conversion_modules.yml b/dist/ssa/detections/ssa___credential_extraction_indicative_of_use_of_dsinternals_credential_conversion_modules.yml
similarity index 100%
rename from dist/ssa/detections/credential_extraction_indicative_of_use_of_dsinternals_credential_conversion_modules.yml
rename to dist/ssa/detections/ssa___credential_extraction_indicative_of_use_of_dsinternals_credential_conversion_modules.yml
diff --git a/dist/ssa/detections/credential_extraction_indicative_of_use_of_dsinternals_modules.yml b/dist/ssa/detections/ssa___credential_extraction_indicative_of_use_of_dsinternals_modules.yml
similarity index 100%
rename from dist/ssa/detections/credential_extraction_indicative_of_use_of_dsinternals_modules.yml
rename to dist/ssa/detections/ssa___credential_extraction_indicative_of_use_of_dsinternals_modules.yml
diff --git a/dist/ssa/detections/credential_extraction_indicative_of_use_of_mimikatz_modules.yml b/dist/ssa/detections/ssa___credential_extraction_indicative_of_use_of_mimikatz_modules.yml
similarity index 100%
rename from dist/ssa/detections/credential_extraction_indicative_of_use_of_mimikatz_modules.yml
rename to dist/ssa/detections/ssa___credential_extraction_indicative_of_use_of_mimikatz_modules.yml
diff --git a/dist/ssa/detections/credential_extraction_indicative_of_use_of_powersploit_modules.yml b/dist/ssa/detections/ssa___credential_extraction_indicative_of_use_of_powersploit_modules.yml
similarity index 100%
rename from dist/ssa/detections/credential_extraction_indicative_of_use_of_powersploit_modules.yml
rename to dist/ssa/detections/ssa___credential_extraction_indicative_of_use_of_powersploit_modules.yml
diff --git a/dist/ssa/detections/credential_extraction_native_microsoft_debuggers_peek_into_the_kernel.yml b/dist/ssa/detections/ssa___credential_extraction_native_microsoft_debuggers_peek_into_the_kernel.yml
similarity index 100%
rename from dist/ssa/detections/credential_extraction_native_microsoft_debuggers_peek_into_the_kernel.yml
rename to dist/ssa/detections/ssa___credential_extraction_native_microsoft_debuggers_peek_into_the_kernel.yml
diff --git a/dist/ssa/detections/credential_extraction_native_microsoft_debuggers_via_z_command_line_option.yml b/dist/ssa/detections/ssa___credential_extraction_native_microsoft_debuggers_via_z_command_line_option.yml
similarity index 100%
rename from dist/ssa/detections/credential_extraction_native_microsoft_debuggers_via_z_command_line_option.yml
rename to dist/ssa/detections/ssa___credential_extraction_native_microsoft_debuggers_via_z_command_line_option.yml
diff --git a/dist/ssa/detections/credential_extraction_via_get-addbaccount_module_present_in_powersploit_and_dsinternals.yml b/dist/ssa/detections/ssa___credential_extraction_via_get-addbaccount_module_present_in_powersploit_and_dsinternals.yml
similarity index 100%
rename from dist/ssa/detections/credential_extraction_via_get-addbaccount_module_present_in_powersploit_and_dsinternals.yml
rename to dist/ssa/detections/ssa___credential_extraction_via_get-addbaccount_module_present_in_powersploit_and_dsinternals.yml
diff --git a/dist/ssa/detections/delete_a_net_user.yml b/dist/ssa/detections/ssa___delete_a_net_user.yml
similarity index 89%
rename from dist/ssa/detections/delete_a_net_user.yml
rename to dist/ssa/detections/ssa___delete_a_net_user.yml
index 00a28f6805..5855416106 100644
--- a/dist/ssa/detections/delete_a_net_user.yml
+++ b/dist/ssa/detections/ssa___delete_a_net_user.yml
@@ -92,5 +92,16 @@ tags:
   risk_score: 49
   risk_severity: medium
   security_domain: endpoint
+test:
+  name: Delete A Net User Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/net_user_del.log
+      file_name: net_user_del.log
+      source: WinEventLog:Security
+    description: Test for usage of net.exe or net1.exe to delete net user
+    file: endpoint/ssa___delete_a_net_user.yml
+    name: Delete A Net User
+    pass_condition: '@count_gt(0)'
 type: Anomaly
 version: 3
diff --git a/dist/ssa/detections/deny_permission_using_cacls_utility.yml b/dist/ssa/detections/ssa___deny_permission_using_cacls_utility.yml
similarity index 86%
rename from dist/ssa/detections/deny_permission_using_cacls_utility.yml
rename to dist/ssa/detections/ssa___deny_permission_using_cacls_utility.yml
index 10736c4b39..3895eb4108 100644
--- a/dist/ssa/detections/deny_permission_using_cacls_utility.yml
+++ b/dist/ssa/detections/ssa___deny_permission_using_cacls_utility.yml
@@ -76,5 +76,16 @@ tags:
   risk_score: 35
   risk_severity: medium
   security_domain: endpoint
+test:
+  name: Deny Permission using Cacls Utility Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log
+      file_name: all_icalc.log
+      source: WinEventLog:Security
+    description: Test for usage of cacls deny permission to a file(s) or folder(s)
+    file: endpoint/ssa___deny_permission_using_cacls_utility.yml
+    name: Deny Permission using Cacls Utility
+    pass_condition: '@count_gt(0)'
 type: TTP
 version: 2
diff --git a/dist/ssa/detections/detect_dump_lsass_memory_using_comsvcs.yml b/dist/ssa/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml
similarity index 85%
rename from dist/ssa/detections/detect_dump_lsass_memory_using_comsvcs.yml
rename to dist/ssa/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml
index 6d4b60ba3e..973e19fa7e 100644
--- a/dist/ssa/detections/detect_dump_lsass_memory_using_comsvcs.yml
+++ b/dist/ssa/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml
@@ -76,5 +76,16 @@ tags:
   risk_score: 70
   risk_severity: low
   security_domain: endpoint
+test:
+  name: Detect Dump LSASS Memory using comsvcs - SSA Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-security.log
+      file_name: windows-security.log
+      source: WinEventLog:Security
+    description: Test credential dumping detections
+    file: endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml
+    name: Detect Dump LSASS Memory using comsvcs
+    pass_condition: '@count_gt(0)'
 type: TTP
 version: 2
diff --git a/dist/ssa/detections/detect_kerberoasting.yml b/dist/ssa/detections/ssa___detect_kerberoasting.yml
similarity index 86%
rename from dist/ssa/detections/detect_kerberoasting.yml
rename to dist/ssa/detections/ssa___detect_kerberoasting.yml
index d05bcbdd64..0d07185006 100644
--- a/dist/ssa/detections/detect_kerberoasting.yml
+++ b/dist/ssa/detections/ssa___detect_kerberoasting.yml
@@ -79,5 +79,16 @@ tags:
   risk_score: 14
   risk_severity: medium
   security_domain: endpoint
+test:
+  name: Detect Kerberoasting - SSA Unit test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/atomic_red_team/windows-security.log
+      file_name: windows-security.log
+      source: WinEventLog:Security
+    description: Test detection of kerberoasting
+    file: endpoint/ssa___detect_kerberoasting.yml
+    name: Detect kerberoasting
+    pass_condition: '@count_eq(0)'
 type: TTP
 version: 2
diff --git a/dist/ssa/detections/detect_pass_the_hash.yml b/dist/ssa/detections/ssa___detect_pass_the_hash.yml
similarity index 100%
rename from dist/ssa/detections/detect_pass_the_hash.yml
rename to dist/ssa/detections/ssa___detect_pass_the_hash.yml
diff --git a/dist/ssa/detections/detect_prohibited_applications_spawning_cmd_exe.yml b/dist/ssa/detections/ssa___detect_prohibited_applications_spawning_cmd_exe.yml
similarity index 86%
rename from dist/ssa/detections/detect_prohibited_applications_spawning_cmd_exe.yml
rename to dist/ssa/detections/ssa___detect_prohibited_applications_spawning_cmd_exe.yml
index 63a5753b23..36dec46f53 100644
--- a/dist/ssa/detections/detect_prohibited_applications_spawning_cmd_exe.yml
+++ b/dist/ssa/detections/ssa___detect_prohibited_applications_spawning_cmd_exe.yml
@@ -1,7 +1,6 @@
 author: Ignacio Bermudez Corrales, Splunk
-datamodel:
-- Endpoint_Processes
-date: '2020-11-10'
+datamodel: []
+date: '2021-11-10'
 description: The following analytic identifies parent processes, browsers, Windows
   terminal applications, Office Products and Java spawning cmd.exe. By its very nature,
   many applications spawn cmd.exe natively or built into macros. Much of this will
@@ -22,7 +21,8 @@ references:
 risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified
   on endpoint $dest_device_id$ by user $dest_user_id$, producing a suspicious event
   that warrants investigating.
-search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
+search: '| from read_ssa_enriched_events()
+
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null))
   | eval process_name=ucast(map_get(input_event, "process_name"), "string", null),
   parent_process=lower(ucast(map_get(input_event, "parent_process_name"), "string",
@@ -88,5 +88,16 @@ tags:
   risk_score: 35
   risk_severity: medium
   security_domain: endpoint
+test:
+  name: Detect Prohibited Applications Spawning cmd exe Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/powershell_spawn_cmd/windows-security.log
+      file_name: windows-security.log
+      source: WinEventLog:Security
+    description: Detect Prohibited Applications Spawning cmd exe
+    file: endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml
+    name: Detect Prohibited Applications Spawning cmd exe
+    pass_condition: '@count_gt(0)'
 type: Anomaly
 version: 2
diff --git a/dist/ssa/detections/disable_net_user_account.yml b/dist/ssa/detections/ssa___disable_net_user_account.yml
similarity index 87%
rename from dist/ssa/detections/disable_net_user_account.yml
rename to dist/ssa/detections/ssa___disable_net_user_account.yml
index 15b035e34d..d5b8c709d9 100644
--- a/dist/ssa/detections/disable_net_user_account.yml
+++ b/dist/ssa/detections/ssa___disable_net_user_account.yml
@@ -88,5 +88,16 @@ tags:
   risk_score: 49
   risk_severity: medium
   security_domain: endpoint
+test:
+  name: Disable Net User Account Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/net_user_dis.log
+      file_name: net_user_dis.log
+      source: WinEventLog:Security
+    description: Test for usage of net.exe or net1.exe to disable net user
+    file: endpoint/ssa___disable_net_user_account.yml
+    name: Disable Net User Account
+    pass_condition: '@count_gt(0)'
 type: TTP
 version: 3
diff --git a/dist/ssa/detections/first_time_seen_command_line_argument.yml b/dist/ssa/detections/ssa___first_time_seen_command_line_argument.yml
similarity index 100%
rename from dist/ssa/detections/first_time_seen_command_line_argument.yml
rename to dist/ssa/detections/ssa___first_time_seen_command_line_argument.yml
diff --git a/dist/ssa/detections/grant_permission_using_cacls_utility.yml b/dist/ssa/detections/ssa___grant_permission_using_cacls_utility.yml
similarity index 85%
rename from dist/ssa/detections/grant_permission_using_cacls_utility.yml
rename to dist/ssa/detections/ssa___grant_permission_using_cacls_utility.yml
index 15589795a0..e0f7f7a46e 100644
--- a/dist/ssa/detections/grant_permission_using_cacls_utility.yml
+++ b/dist/ssa/detections/ssa___grant_permission_using_cacls_utility.yml
@@ -76,5 +76,16 @@ tags:
   risk_score: 35
   risk_severity: medium
   security_domain: endpoint
+test:
+  name: Grant Permission Using Cacls Utility Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log
+      file_name: all_icalc.log
+      source: WinEventLog:Security
+    description: Test for usage of cacls grant permission to a file(s) or folder(s)
+    file: endpoint/ssa___grant_permission_using_cacls_utility.yml
+    name: Grant Permission Using Cacls Utility
+    pass_condition: '@count_gt(0)'
 type: TTP
 version: 2
diff --git a/dist/ssa/detections/illegal_access_to_user_content_via_powersploit_modules.yml b/dist/ssa/detections/ssa___illegal_access_to_user_content_via_powersploit_modules.yml
similarity index 100%
rename from dist/ssa/detections/illegal_access_to_user_content_via_powersploit_modules.yml
rename to dist/ssa/detections/ssa___illegal_access_to_user_content_via_powersploit_modules.yml
diff --git a/dist/ssa/detections/illegal_account_creation_via_powersploit_modules.yml b/dist/ssa/detections/ssa___illegal_account_creation_via_powersploit_modules.yml
similarity index 80%
rename from dist/ssa/detections/illegal_account_creation_via_powersploit_modules.yml
rename to dist/ssa/detections/ssa___illegal_account_creation_via_powersploit_modules.yml
index a9be3d6fec..a39c613a8b 100644
--- a/dist/ssa/detections/illegal_account_creation_via_powersploit_modules.yml
+++ b/dist/ssa/detections/ssa___illegal_account_creation_via_powersploit_modules.yml
@@ -75,5 +75,16 @@ tags:
   risk_score: 80
   risk_severity: high
   security_domain: endpoint
+test:
+  name: Illegal Account Creation via PowerSploit modules - SSA Unit test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021/illegal_access_to_content/logAllPowerSploitModulesWithOldNames.log
+      file_name: logAllPowerSploitModulesWithOldNames.log
+      source: WinEventLog:Security
+    description: Test illegal account creation detections
+    file: endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml
+    name: Illegal Account Creation via PowerSploit modules
+    pass_condition: '@count_gt(0)'
 type: TTP
 version: 1
diff --git a/dist/ssa/detections/illegal_deletion_of_logs_via_mimikatz_modules.yml b/dist/ssa/detections/ssa___illegal_deletion_of_logs_via_mimikatz_modules.yml
similarity index 100%
rename from dist/ssa/detections/illegal_deletion_of_logs_via_mimikatz_modules.yml
rename to dist/ssa/detections/ssa___illegal_deletion_of_logs_via_mimikatz_modules.yml
diff --git a/dist/ssa/detections/illegal_enabling_or_disabling_of_accounts_via_dsinternals_modules.yml b/dist/ssa/detections/ssa___illegal_enabling_or_disabling_of_accounts_via_dsinternals_modules.yml
similarity index 100%
rename from dist/ssa/detections/illegal_enabling_or_disabling_of_accounts_via_dsinternals_modules.yml
rename to dist/ssa/detections/ssa___illegal_enabling_or_disabling_of_accounts_via_dsinternals_modules.yml
diff --git a/dist/ssa/detections/illegal_management_of_active_directory_elements_and_policies_via_dsinternals_modules.yml b/dist/ssa/detections/ssa___illegal_management_of_active_directory_elements_and_policies_via_dsinternals_modules.yml
similarity index 100%
rename from dist/ssa/detections/illegal_management_of_active_directory_elements_and_policies_via_dsinternals_modules.yml
rename to dist/ssa/detections/ssa___illegal_management_of_active_directory_elements_and_policies_via_dsinternals_modules.yml
diff --git a/dist/ssa/detections/illegal_management_of_computers_and_active_directory_elements_via_powersploit_modules.yml b/dist/ssa/detections/ssa___illegal_management_of_computers_and_active_directory_elements_via_powersploit_modules.yml
similarity index 100%
rename from dist/ssa/detections/illegal_management_of_computers_and_active_directory_elements_via_powersploit_modules.yml
rename to dist/ssa/detections/ssa___illegal_management_of_computers_and_active_directory_elements_via_powersploit_modules.yml
diff --git a/dist/ssa/detections/illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml b/dist/ssa/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml
similarity index 82%
rename from dist/ssa/detections/illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml
rename to dist/ssa/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml
index ba168bbac9..b29dfa4bd6 100644
--- a/dist/ssa/detections/illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml
+++ b/dist/ssa/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml
@@ -84,5 +84,17 @@ tags:
   risk_score: 90
   risk_severity: high
   security_domain: endpoint
+test:
+  name: Illegal Privilege Elevation and Persistence via PowerSploit modules - SSA
+    Unit test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/logAllPowerSploitModulesWithOldNames.log
+      file_name: logAllPowerSploitModulesWithOldNames.log
+      source: WinEventLog:Security
+    description: Test privilege elevation and persistence detections
+    file: endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml
+    name: Illegal Privilege Elevation and Persistence via PowerSploit modules
+    pass_condition: '@count_gt(0)'
 type: TTP
 version: 1
diff --git a/dist/ssa/detections/illegal_privilege_elevation_via_mimikatz_modules.yml b/dist/ssa/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml
similarity index 82%
rename from dist/ssa/detections/illegal_privilege_elevation_via_mimikatz_modules.yml
rename to dist/ssa/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml
index ce8f5ff677..4ad98e61aa 100644
--- a/dist/ssa/detections/illegal_privilege_elevation_via_mimikatz_modules.yml
+++ b/dist/ssa/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml
@@ -79,5 +79,16 @@ tags:
   risk_score: 90
   risk_severity: high
   security_domain: endpoint
+test:
+  name: Illegal Privilege Elevation via Mimikatz modules - SSA Unit test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/logAllMimikatzModules.log
+      file_name: logAllMimikatzModules.log
+      source: WinEventLog:Security
+    description: Test illegal privilege elevation detections
+    file: endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml
+    name: Illegal Privilege Elevation via Mimikatz modules
+    pass_condition: '@count_gt(0)'
 type: TTP
 version: 1
diff --git a/dist/ssa/detections/illegal_service_and_process_control_via_mimikatz_modules.yml b/dist/ssa/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml
similarity index 82%
rename from dist/ssa/detections/illegal_service_and_process_control_via_mimikatz_modules.yml
rename to dist/ssa/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml
index 2141556460..d657ae5d90 100644
--- a/dist/ssa/detections/illegal_service_and_process_control_via_mimikatz_modules.yml
+++ b/dist/ssa/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml
@@ -81,5 +81,16 @@ tags:
   risk_score: 90
   risk_severity: high
   security_domain: endpoint
+test:
+  name: Illegal Service and Process Control via Mimikatz modules - SSA Unit test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllMimikatzModules.log
+      file_name: logAllMimikatzModules.log
+      source: WinEventLog:Security
+    description: Test illegal service and process control detections
+    file: endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml
+    name: Illegal Service and Process Control via Mimikatz modules
+    pass_condition: '@count_gt(0)'
 type: TTP
 version: 1
diff --git a/dist/ssa/detections/illegal_service_and_process_control_via_powersploit_modules.yml b/dist/ssa/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml
similarity index 84%
rename from dist/ssa/detections/illegal_service_and_process_control_via_powersploit_modules.yml
rename to dist/ssa/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml
index 32199adea3..b20b688d27 100644
--- a/dist/ssa/detections/illegal_service_and_process_control_via_powersploit_modules.yml
+++ b/dist/ssa/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml
@@ -91,5 +91,16 @@ tags:
   risk_score: 90
   risk_severity: high
   security_domain: endpoint
+test:
+  name: Illegal Service and Process Control via PowerSploit modules - SSA Unit test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log
+      file_name: logAllPowerSploitModulesWithOldNames.log
+      source: WinEventLog:Security
+    description: Test illegal service and process control detections
+    file: endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml
+    name: Illegal Service and Process Control via PowerSploit modules
+    pass_condition: '@count_gt(0)'
 type: TTP
 version: 1
diff --git a/dist/ssa/detections/modify_acls_permission_of_files_or_folders.yml b/dist/ssa/detections/ssa___modify_acls_permission_of_files_or_folders.yml
similarity index 86%
rename from dist/ssa/detections/modify_acls_permission_of_files_or_folders.yml
rename to dist/ssa/detections/ssa___modify_acls_permission_of_files_or_folders.yml
index 3dd5704539..1710b5a796 100644
--- a/dist/ssa/detections/modify_acls_permission_of_files_or_folders.yml
+++ b/dist/ssa/detections/ssa___modify_acls_permission_of_files_or_folders.yml
@@ -79,5 +79,17 @@ tags:
   risk_score: 35
   risk_severity: medium
   security_domain: endpoint
+test:
+  name: Modify ACLs Permission Of Files Or Folders Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log
+      file_name: all_icalc.log
+      source: WinEventLog:Security
+    description: Test for modifying permission of a file(s) or folder(s) using cacls
+      utility.
+    file: endpoint/ssa___modify_acls_permission_of_files_or_folders.yml
+    name: Modify ACLs Permission Of Files Or Folders
+    pass_condition: '@count_gt(0)'
 type: Anomaly
 version: 1
diff --git a/dist/ssa/detections/more_than_usual_number_of_lolbas_applications_in_short_time_period.yml b/dist/ssa/detections/ssa___more_than_usual_number_of_lolbas_applications_in_short_time_period.yml
similarity index 100%
rename from dist/ssa/detections/more_than_usual_number_of_lolbas_applications_in_short_time_period.yml
rename to dist/ssa/detections/ssa___more_than_usual_number_of_lolbas_applications_in_short_time_period.yml
diff --git a/dist/ssa/detections/phishing_email_detection_by_machine_learning_method_-_ssa.yml b/dist/ssa/detections/ssa___phishing_email_detection_by_machine_learning_method_-_ssa.yml
similarity index 100%
rename from dist/ssa/detections/phishing_email_detection_by_machine_learning_method_-_ssa.yml
rename to dist/ssa/detections/ssa___phishing_email_detection_by_machine_learning_method_-_ssa.yml
diff --git a/dist/ssa/detections/potential_pass_the_token_or_hash_observed_at_the_destination_device.yml b/dist/ssa/detections/ssa___potential_pass_the_token_or_hash_observed_at_the_destination_device.yml
similarity index 100%
rename from dist/ssa/detections/potential_pass_the_token_or_hash_observed_at_the_destination_device.yml
rename to dist/ssa/detections/ssa___potential_pass_the_token_or_hash_observed_at_the_destination_device.yml
diff --git a/dist/ssa/detections/potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml b/dist/ssa/detections/ssa___potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml
similarity index 100%
rename from dist/ssa/detections/potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml
rename to dist/ssa/detections/ssa___potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml
diff --git a/dist/ssa/detections/probing_access_with_stolen_credentials_via_powersploit_modules.yml b/dist/ssa/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml
similarity index 79%
rename from dist/ssa/detections/probing_access_with_stolen_credentials_via_powersploit_modules.yml
rename to dist/ssa/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml
index 1aa77e8aa2..492453c5b0 100644
--- a/dist/ssa/detections/probing_access_with_stolen_credentials_via_powersploit_modules.yml
+++ b/dist/ssa/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml
@@ -76,5 +76,17 @@ tags:
   risk_score: 60
   risk_severity: low
   security_domain: endpoint
+test:
+  name: Probing Access with Stolen Credentials via PowerSploit modules - SSA Unit
+    test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log
+      file_name: logAllPowerSploitModulesWithOldNames.log
+      source: WinEventLog:Security
+    description: Test access probing with stolen credentials detections
+    file: endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml
+    name: Probing Access with Stolen Credentials via PowerSploit modules
+    pass_condition: '@count_gt(0)'
 type: TTP
 version: 1
diff --git a/dist/ssa/detections/rare_parent-child_process_relationship.yml b/dist/ssa/detections/ssa___rare_parent-child_process_relationship.yml
similarity index 100%
rename from dist/ssa/detections/rare_parent-child_process_relationship.yml
rename to dist/ssa/detections/ssa___rare_parent-child_process_relationship.yml
diff --git a/dist/ssa/detections/reconnaissance_and_access_to_accounts_and_groups_via_mimikatz_modules.yml b/dist/ssa/detections/ssa___reconnaissance_and_access_to_accounts_and_groups_via_mimikatz_modules.yml
similarity index 100%
rename from dist/ssa/detections/reconnaissance_and_access_to_accounts_and_groups_via_mimikatz_modules.yml
rename to dist/ssa/detections/ssa___reconnaissance_and_access_to_accounts_and_groups_via_mimikatz_modules.yml
diff --git a/dist/ssa/detections/reconnaissance_and_access_to_accounts_groups_and_policies_via_powersploit_modules.yml b/dist/ssa/detections/ssa___reconnaissance_and_access_to_accounts_groups_and_policies_via_powersploit_modules.yml
similarity index 100%
rename from dist/ssa/detections/reconnaissance_and_access_to_accounts_groups_and_policies_via_powersploit_modules.yml
rename to dist/ssa/detections/ssa___reconnaissance_and_access_to_accounts_groups_and_policies_via_powersploit_modules.yml
diff --git a/dist/ssa/detections/reconnaissance_and_access_to_active_directoty_infrastructure_via_powersploit_modules.yml b/dist/ssa/detections/ssa___reconnaissance_and_access_to_active_directoty_infrastructure_via_powersploit_modules.yml
similarity index 100%
rename from dist/ssa/detections/reconnaissance_and_access_to_active_directoty_infrastructure_via_powersploit_modules.yml
rename to dist/ssa/detections/ssa___reconnaissance_and_access_to_active_directoty_infrastructure_via_powersploit_modules.yml
diff --git a/dist/ssa/detections/reconnaissance_and_access_to_computers_and_domains_via_powersploit_modules.yml b/dist/ssa/detections/ssa___reconnaissance_and_access_to_computers_and_domains_via_powersploit_modules.yml
similarity index 100%
rename from dist/ssa/detections/reconnaissance_and_access_to_computers_and_domains_via_powersploit_modules.yml
rename to dist/ssa/detections/ssa___reconnaissance_and_access_to_computers_and_domains_via_powersploit_modules.yml
diff --git a/dist/ssa/detections/reconnaissance_and_access_to_computers_via_mimikatz_modules.yml b/dist/ssa/detections/ssa___reconnaissance_and_access_to_computers_via_mimikatz_modules.yml
similarity index 100%
rename from dist/ssa/detections/reconnaissance_and_access_to_computers_via_mimikatz_modules.yml
rename to dist/ssa/detections/ssa___reconnaissance_and_access_to_computers_via_mimikatz_modules.yml
diff --git a/dist/ssa/detections/reconnaissance_and_access_to_operating_system_elements_via_powersploit_modules.yml b/dist/ssa/detections/ssa___reconnaissance_and_access_to_operating_system_elements_via_powersploit_modules.yml
similarity index 100%
rename from dist/ssa/detections/reconnaissance_and_access_to_operating_system_elements_via_powersploit_modules.yml
rename to dist/ssa/detections/ssa___reconnaissance_and_access_to_operating_system_elements_via_powersploit_modules.yml
diff --git a/dist/ssa/detections/reconnaissance_and_access_to_processes_and_services_via_mimikatz_modules.yml b/dist/ssa/detections/ssa___reconnaissance_and_access_to_processes_and_services_via_mimikatz_modules.yml
similarity index 100%
rename from dist/ssa/detections/reconnaissance_and_access_to_processes_and_services_via_mimikatz_modules.yml
rename to dist/ssa/detections/ssa___reconnaissance_and_access_to_processes_and_services_via_mimikatz_modules.yml
diff --git a/dist/ssa/detections/reconnaissance_and_access_to_shared_resources_via_mimikatz_modules.yml b/dist/ssa/detections/ssa___reconnaissance_and_access_to_shared_resources_via_mimikatz_modules.yml
similarity index 100%
rename from dist/ssa/detections/reconnaissance_and_access_to_shared_resources_via_mimikatz_modules.yml
rename to dist/ssa/detections/ssa___reconnaissance_and_access_to_shared_resources_via_mimikatz_modules.yml
diff --git a/dist/ssa/detections/reconnaissance_and_access_to_shared_resources_via_powersploit_modules.yml b/dist/ssa/detections/ssa___reconnaissance_and_access_to_shared_resources_via_powersploit_modules.yml
similarity index 100%
rename from dist/ssa/detections/reconnaissance_and_access_to_shared_resources_via_powersploit_modules.yml
rename to dist/ssa/detections/ssa___reconnaissance_and_access_to_shared_resources_via_powersploit_modules.yml
diff --git a/dist/ssa/detections/reconnaissance_of_access_and_persistence_opportunities_via_powersploit_modules.yml b/dist/ssa/detections/ssa___reconnaissance_of_access_and_persistence_opportunities_via_powersploit_modules.yml
similarity index 100%
rename from dist/ssa/detections/reconnaissance_of_access_and_persistence_opportunities_via_powersploit_modules.yml
rename to dist/ssa/detections/ssa___reconnaissance_of_access_and_persistence_opportunities_via_powersploit_modules.yml
diff --git a/dist/ssa/detections/reconnaissance_of_connectivity_via_powersploit_modules.yml b/dist/ssa/detections/ssa___reconnaissance_of_connectivity_via_powersploit_modules.yml
similarity index 100%
rename from dist/ssa/detections/reconnaissance_of_connectivity_via_powersploit_modules.yml
rename to dist/ssa/detections/ssa___reconnaissance_of_connectivity_via_powersploit_modules.yml
diff --git a/dist/ssa/detections/reconnaissance_of_credential_stores_and_services_via_mimikatz_modules.yml b/dist/ssa/detections/ssa___reconnaissance_of_credential_stores_and_services_via_mimikatz_modules.yml
similarity index 100%
rename from dist/ssa/detections/reconnaissance_of_credential_stores_and_services_via_mimikatz_modules.yml
rename to dist/ssa/detections/ssa___reconnaissance_of_credential_stores_and_services_via_mimikatz_modules.yml
diff --git a/dist/ssa/detections/reconnaissance_of_defensive_tools_via_powersploit_modules.yml b/dist/ssa/detections/ssa___reconnaissance_of_defensive_tools_via_powersploit_modules.yml
similarity index 100%
rename from dist/ssa/detections/reconnaissance_of_defensive_tools_via_powersploit_modules.yml
rename to dist/ssa/detections/ssa___reconnaissance_of_defensive_tools_via_powersploit_modules.yml
diff --git a/dist/ssa/detections/reconnaissance_of_privilege_escalation_opportunities_via_powersploit_modules.yml b/dist/ssa/detections/ssa___reconnaissance_of_privilege_escalation_opportunities_via_powersploit_modules.yml
similarity index 100%
rename from dist/ssa/detections/reconnaissance_of_privilege_escalation_opportunities_via_powersploit_modules.yml
rename to dist/ssa/detections/ssa___reconnaissance_of_privilege_escalation_opportunities_via_powersploit_modules.yml
diff --git a/dist/ssa/detections/reconnaissance_of_process_or_service_hijacking_opportunities_via_mimikatz_modules.yml b/dist/ssa/detections/ssa___reconnaissance_of_process_or_service_hijacking_opportunities_via_mimikatz_modules.yml
similarity index 100%
rename from dist/ssa/detections/reconnaissance_of_process_or_service_hijacking_opportunities_via_mimikatz_modules.yml
rename to dist/ssa/detections/ssa___reconnaissance_of_process_or_service_hijacking_opportunities_via_mimikatz_modules.yml
diff --git a/dist/ssa/detections/resize_shadowstorage_volume.yml b/dist/ssa/detections/ssa___resize_shadowstorage_volume.yml
similarity index 88%
rename from dist/ssa/detections/resize_shadowstorage_volume.yml
rename to dist/ssa/detections/ssa___resize_shadowstorage_volume.yml
index 9b35c7c37c..770e08ae8c 100644
--- a/dist/ssa/detections/resize_shadowstorage_volume.yml
+++ b/dist/ssa/detections/ssa___resize_shadowstorage_volume.yml
@@ -92,5 +92,16 @@ tags:
   risk_score: 64
   risk_severity: low
   security_domain: endpoint
+test:
+  name: Resize Shadowstorage Volume Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/windows-security.log
+      file_name: windows-security.log
+      source: WinEventLog:Security
+    description: Test for resizing the shadow storage of a machine
+    file: endpoint/ssa___resize_shadowstorage_volume.yml
+    name: Resize Shadowstorage Volume
+    pass_condition: '@count_gt(0)'
 type: TTP
 version: 2
diff --git a/dist/ssa/detections/ssa___sdelete_application_execution.yml b/dist/ssa/detections/ssa___sdelete_application_execution.yml
new file mode 100644
index 0000000000..44341ebf5a
--- /dev/null
+++ b/dist/ssa/detections/ssa___sdelete_application_execution.yml
@@ -0,0 +1,105 @@
+author: Teoderick Contreras, Splunk
+datamodel:
+- Endpoint
+date: '2021-11-15'
+description: This analytic will detect the execution of sdelete.exe attempting to
+  delete potentially important files that may related to adversary or insider threats
+  to destroy evidence or information sabotage. Sdelete is a SysInternals utility meant
+  to securely delete files on disk. This tool is commonly used to clear tracks and
+  artifact on the targeted host.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: fcc52b9a-4616-11ec-8454-acde48001122
+known_false_positives: False positives should be limited, filter as needed.
+name: Sdelete Application Execution
+product:
+- Splunk Behavioral Analytics
+references:
+- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1485/T1485.md
+risk_message: sdelete process $process_name$ executed on $dest$ attempting to permanently
+  delete files.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,"_time"),
+  "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), "string",
+  null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
+  null)), process_path=ucast(map_get(input_event, "process_path"), "string", null),
+  parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), parent_cmd_line=ucast(map_get(input_event, "parent_process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
+  IS NOT NULL AND process_name IS NOT NULL AND like(process_name, "%sdelete%") AND
+  (like (cmd_line, "%-c %") OR like (cmd_line, "%-f %")OR like (cmd_line, "%-p %")
+  OR like (cmd_line, "%-r %") OR like (cmd_line, "%-q %") OR like (cmd_line, "%-s
+  %") OR like (cmd_line, "%-z %") OR like (cmd_line, "%/accepteula%") OR like (cmd_line,
+  "%-nobanner%")OR like (cmd_line, "%.doc%")OR like (cmd_line, "%.xls%") OR like (cmd_line,
+  "%.ppt%")OR like (cmd_line, "%.rtf%") OR like (cmd_line, "%.pdf%") OR like (cmd_line,
+  "%.key%")OR like (cmd_line, "%.log%") OR like (cmd_line, "%.txt%") OR like (cmd_line,
+  "%.jpg%") OR like (cmd_line, "%.png%") OR like (cmd_line, "%.gif%") OR like (cmd_line,
+  "%.bmp%") OR like (cmd_line, "%.7z%")  OR like (cmd_line, "%.zip%") OR like (cmd_line,
+  "%.rar%") OR like (cmd_line, "%.tar%") OR like (cmd_line, "%.gz%") OR like (cmd_line,
+  "%.xls%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name, "process_path", process_path, "parent_process_name", parent_process_name,
+  "parent_cmd_line", parent_cmd_line]) | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Information Sabotage
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/sdelete/security.log
+  impact: 60
+  kill_chain_phases:
+  - Exploitation
+  message: sdelete process $process_name$ executed on $dest$ attempting to permanently
+    delete files.
+  mitre_attack_id:
+  - T1485
+  - T1070.004
+  - T1070
+  observable:
+  - name: dest
+    role:
+    - Victim
+    type: Endpoint
+  - name: user
+    role:
+    - Victim
+    type: User
+  - name: process_name
+    role:
+    - Child Process
+    type: Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest
+  - user
+  - parent_process_name
+  - parent_process
+  - process_name
+  - process
+  - process_id
+  - process_path
+  risk_score: 42
+  risk_severity: medium
+  security_domain: endpoint
+test:
+  name: Sdelete Application Execution Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/sdelete/security.log
+      file_name: security.log
+      source: WinEventLog:Security
+    description: Test for sdelete execution command
+    file: endpoint/ssa___sdelete_application_execution.yml
+    name: Sdelete Application Execution
+    pass_condition: '@count_gt(0)'
+type: Anomaly
+version: 1
diff --git a/dist/ssa/detections/setting_credentials_via_dsinternals_modules.yml b/dist/ssa/detections/ssa___setting_credentials_via_dsinternals_modules.yml
similarity index 85%
rename from dist/ssa/detections/setting_credentials_via_dsinternals_modules.yml
rename to dist/ssa/detections/ssa___setting_credentials_via_dsinternals_modules.yml
index 8e0eb1409e..965f28156f 100644
--- a/dist/ssa/detections/setting_credentials_via_dsinternals_modules.yml
+++ b/dist/ssa/detections/ssa___setting_credentials_via_dsinternals_modules.yml
@@ -88,5 +88,16 @@ tags:
   risk_score: 80
   risk_severity: high
   security_domain: endpoint
+test:
+  name: Setting Credentials via DSInternals modules - SSA Unit test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllDSInternalsModules.log
+      file_name: logAllDSInternalsModules.log
+      source: WinEventLog:Security
+    description: Test illegal credential setting detections
+    file: endpoint/ssa___setting_credentials_via_dsinternals_modules.yml
+    name: Setting Credentials via DSInternals modules
+    pass_condition: '@count_gt(0)'
 type: TTP
 version: 1
diff --git a/dist/ssa/detections/setting_credentials_via_mimikatz_modules.yml b/dist/ssa/detections/ssa___setting_credentials_via_mimikatz_modules.yml
similarity index 82%
rename from dist/ssa/detections/setting_credentials_via_mimikatz_modules.yml
rename to dist/ssa/detections/ssa___setting_credentials_via_mimikatz_modules.yml
index 17e3b12968..bc2f9b72a3 100644
--- a/dist/ssa/detections/setting_credentials_via_mimikatz_modules.yml
+++ b/dist/ssa/detections/ssa___setting_credentials_via_mimikatz_modules.yml
@@ -78,5 +78,16 @@ tags:
   risk_score: 80
   risk_severity: high
   security_domain: endpoint
+test:
+  name: Setting Credentials via Mimikatz modules - SSA Unit test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllMimikatzModules.log
+      file_name: logAllMimikatzModules.log
+      source: WinEventLog:Security
+    description: Test illegal credential setting detections
+    file: endpoint/ssa___setting_credentials_via_mimikatz_modules.yml
+    name: Setting Credentials via Mimikatz modules
+    pass_condition: '@count_gt(0)'
 type: TTP
 version: 1
diff --git a/dist/ssa/detections/setting_credentials_via_powersploit_modules.yml b/dist/ssa/detections/ssa___setting_credentials_via_powersploit_modules.yml
similarity index 81%
rename from dist/ssa/detections/setting_credentials_via_powersploit_modules.yml
rename to dist/ssa/detections/ssa___setting_credentials_via_powersploit_modules.yml
index a811699f07..9d97499fde 100644
--- a/dist/ssa/detections/setting_credentials_via_powersploit_modules.yml
+++ b/dist/ssa/detections/ssa___setting_credentials_via_powersploit_modules.yml
@@ -78,5 +78,16 @@ tags:
   risk_score: 90
   risk_severity: high
   security_domain: endpoint
+test:
+  name: Setting Credentials via PowerSploit modules - SSA Unit test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log
+      file_name: logAllPowerSploitModulesWithOldNames.log
+      source: WinEventLog:Security
+    description: Test illegal credential setting detections
+    file: endpoint/ssa___setting_credentials_via_powersploit_modules.yml
+    name: Setting Credentials via PowerSploit modules
+    pass_condition: '@count_gt(0)'
 type: TTP
 version: 1
diff --git a/dist/ssa/detections/system_process_running_from_unexpected_location.yml b/dist/ssa/detections/ssa___system_process_running_from_unexpected_location.yml
similarity index 100%
rename from dist/ssa/detections/system_process_running_from_unexpected_location.yml
rename to dist/ssa/detections/ssa___system_process_running_from_unexpected_location.yml
diff --git a/dist/ssa/detections/unusually_long_command_line.yml b/dist/ssa/detections/ssa___unusually_long_command_line.yml
similarity index 86%
rename from dist/ssa/detections/unusually_long_command_line.yml
rename to dist/ssa/detections/ssa___unusually_long_command_line.yml
index 063ee9f4ad..7431805fa7 100644
--- a/dist/ssa/detections/unusually_long_command_line.yml
+++ b/dist/ssa/detections/ssa___unusually_long_command_line.yml
@@ -72,5 +72,16 @@ tags:
   risk_score: 12
   risk_severity: medium
   security_domain: endpoint
+test:
+  name: Unusually Long Command Line - SSA Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/unusally_cmd_line/windows-security.log
+      file_name: windows-security.log
+      source: WinEventLog:Security
+    description: Test unusually long command lines
+    file: endpoint/ssa___unusually_long_command_line.yml
+    name: Unusually Long Command Line
+    pass_condition: '@count_gt(0)'
 type: Anomaly
 version: 1
diff --git a/dist/ssa/detections/wevtutil_usage_to_clear_logs.yml b/dist/ssa/detections/ssa___wevtutil_usage_to_clear_logs.yml
similarity index 87%
rename from dist/ssa/detections/wevtutil_usage_to_clear_logs.yml
rename to dist/ssa/detections/ssa___wevtutil_usage_to_clear_logs.yml
index 9ac8c15199..aaeeca58e6 100644
--- a/dist/ssa/detections/wevtutil_usage_to_clear_logs.yml
+++ b/dist/ssa/detections/ssa___wevtutil_usage_to_clear_logs.yml
@@ -82,5 +82,16 @@ tags:
   risk_score: 63
   risk_severity: low
   security_domain: endpoint
+test:
+  name: WevtUtil Usage To Clear Logs Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/clear_evt.log
+      file_name: clear_evt.log
+      source: WinEventLog:Security
+    description: Test for wevtutil clear logs command
+    file: endpoint/ssa___wevtutil_usage_to_clear_logs.yml
+    name: WevtUtil Usage To Clear Logs
+    pass_condition: '@count_gt(0)'
 type: TTP
 version: 2
diff --git a/dist/ssa/detections/wevtutil_usage_to_disable_logs.yml b/dist/ssa/detections/ssa___wevtutil_usage_to_disable_logs.yml
similarity index 86%
rename from dist/ssa/detections/wevtutil_usage_to_disable_logs.yml
rename to dist/ssa/detections/ssa___wevtutil_usage_to_disable_logs.yml
index 94c185b294..72fb55c1ca 100644
--- a/dist/ssa/detections/wevtutil_usage_to_disable_logs.yml
+++ b/dist/ssa/detections/ssa___wevtutil_usage_to_disable_logs.yml
@@ -78,5 +78,16 @@ tags:
   risk_score: 63
   risk_severity: low
   security_domain: endpoint
+test:
+  name: Wevtutil Usage To Disable Logs Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/disable_evt.log
+      file_name: disable_evt.log
+      source: WinEventLog:Security
+    description: Test for wevtutil disable logs command
+    file: endpoint/ssa___wevtutil_usage_to_disable_logs.yml
+    name: Wevtutil Usage To Disable Logs
+    pass_condition: '@count_gt(0)'
 type: TTP
 version: 2