diff --git a/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_yml_adapter.py b/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_yml_adapter.py
index 13ec4a0e4b..361910bb34 100644
--- a/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_yml_adapter.py
+++ b/bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_yml_adapter.py
@@ -47,6 +47,7 @@ class ObjToYmlAdapter(Adapter):
                                 "kill_chain_phases": True,
                                 "mitre_attack_id": True,
                                 "risk_severity": True,
+                                "risk_score": True,
                                 "security_domain": True,
                                 "required_fields": True
                             },
diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_yml_data/srs/ssa___anomalous_usage_of_archive_tools.yml b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_yml_data/srs/ssa___anomalous_usage_of_archive_tools.yml
index 1901740dbd..d5123ab61a 100644
--- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_yml_data/srs/ssa___anomalous_usage_of_archive_tools.yml
+++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_yml_data/srs/ssa___anomalous_usage_of_archive_tools.yml
@@ -50,6 +50,7 @@ tags:
   - Processes.user
   - Processes.parent_process_name
   - Processes.parent_process
+  risk_score: 42
   security_domain: endpoint
   risk_severity: low
 test:
diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_yml_data_ref/srs/ssa___anomalous_usage_of_archive_tools.yml b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_yml_data_ref/srs/ssa___anomalous_usage_of_archive_tools.yml
index 1901740dbd..d5123ab61a 100644
--- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_yml_data_ref/srs/ssa___anomalous_usage_of_archive_tools.yml
+++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_yml_data_ref/srs/ssa___anomalous_usage_of_archive_tools.yml
@@ -50,6 +50,7 @@ tags:
   - Processes.user
   - Processes.parent_process_name
   - Processes.parent_process
+  risk_score: 42
   security_domain: endpoint
   risk_severity: low
 test:
diff --git a/dist/ssa/complex/ssa___potential_pass_the_token_or_hash_observed_at_the_destination_device.yml b/dist/ssa/complex/ssa___potential_pass_the_token_or_hash_observed_at_the_destination_device.yml
index db66eff45f..50176b6c4d 100644
--- a/dist/ssa/complex/ssa___potential_pass_the_token_or_hash_observed_at_the_destination_device.yml
+++ b/dist/ssa/complex/ssa___potential_pass_the_token_or_hash_observed_at_the_destination_device.yml
@@ -65,6 +65,7 @@ tags:
   - dest_user_id
   - dest_device_id
   - authentication_method
+  risk_score: 72
   security_domain: endpoint
   risk_severity: medium
 test:
diff --git a/dist/ssa/complex/ssa___potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml b/dist/ssa/complex/ssa___potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml
index 35758d3d09..50017a1216 100644
--- a/dist/ssa/complex/ssa___potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml
+++ b/dist/ssa/complex/ssa___potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml
@@ -66,6 +66,7 @@ tags:
   - dest_user_id
   - origin_device_id
   - authentication_method
+  risk_score: 64
   security_domain: endpoint
   risk_severity: medium
 test:
diff --git a/dist/ssa/complex/ssa___unusual_lolbas_in_short_period_of_time.yml b/dist/ssa/complex/ssa___unusual_lolbas_in_short_period_of_time.yml
index b996ebc893..b19fe602bd 100644
--- a/dist/ssa/complex/ssa___unusual_lolbas_in_short_period_of_time.yml
+++ b/dist/ssa/complex/ssa___unusual_lolbas_in_short_period_of_time.yml
@@ -63,6 +63,7 @@ tags:
   - dest_device_id
   - _time
   - process_name
+  risk_score: 25
   security_domain: endpoint
   risk_severity: low
 test:
diff --git a/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml b/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml
index 1901740dbd..f0813ee8ba 100644
--- a/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml
+++ b/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml
@@ -12,18 +12,11 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
   event_id=ucast(map_get(input_event, "event_id"), "string", null) | where process_name
   IS NOT NULL AND parent_process_name IS NOT NULL | where like(process_name, "7z%")
   OR process_name="WinRAR.exe" OR like(process_name, "winzip%") | where like(parent_process_name,
-  "%cmd.exe") OR like(parent_process_name, "%powershell.exe") | eval body=create_map("category_id", 101, "class_id", 101000, "detection_start_time", start_time, 
-  "detection_end_time", end_time, "device_entities", [create_map("uid", ucast(map_get(input_event, "enrichments.device_entities.device.uid"), "string", null), "type_id", 0)], 
-  "disposition_id", 1, "end_time", end_time, "event_id", 10100001, "event_time", timestamp, 
-  "finding", create_map("confidence", 60, "confidence_id", 2, 
-  "context_ids", [10, 49], "impact", 70, "impact_id", 4,
-  "kill_chain_phase", Exploitation, "kill_chain_phase_id", 4, 
-  "risk_level", Medium, "risk_level_id", 2, "type_id", 1, "ref_event_uid", event_id), 
-  "message", An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$. This behavior is indicative of suspicious loading of 7zip., "metadata", create_map("log_name", Endpoint_Processes, "version",
-  "1.0.0"), "observables", , "origin", create_map("product", create_map("name", "Splunk Behavioral Analytics")), 
-  "rule", create_map("name", "Anomalous usage of Archive Tools", "uid", "63614a58-10e2-4c6c-ae81-ea1113681439", "version", "1"), "start_time", start_time, "time", start_time,
-  "user_entities", [create_map("uid", ucast(map_get(input_event, "enrichments.user_entities.user.uid"),"string", null))])
-  | into write_ssa_finding_events();'
+  "%cmd.exe") OR like(parent_process_name, "%powershell.exe") | eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
+  body=create_map(["event_id", event_id, "process_name", process_name, "parent_process_name",
+  parent_process_name, "process_path", process_path]) | into write_ssa_detected_events();'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node.
@@ -50,6 +43,7 @@ tags:
   - Processes.user
   - Processes.parent_process_name
   - Processes.parent_process
+  risk_score: 42
   security_domain: endpoint
   risk_severity: low
 test:
diff --git a/dist/ssa/srs/ssa___attempt_to_delete_services.yml b/dist/ssa/srs/ssa___attempt_to_delete_services.yml
index aebe900c07..cf50f2edcc 100644
--- a/dist/ssa/srs/ssa___attempt_to_delete_services.yml
+++ b/dist/ssa/srs/ssa___attempt_to_delete_services.yml
@@ -52,6 +52,7 @@ tags:
   - dest_user_id
   - process
   - cmd_line
+  risk_score: 36
   security_domain: endpoint
   risk_severity: low
 test:
diff --git a/dist/ssa/srs/ssa___attempt_to_disable_services.yml b/dist/ssa/srs/ssa___attempt_to_disable_services.yml
index bdd059f566..2cfaca6e36 100644
--- a/dist/ssa/srs/ssa___attempt_to_disable_services.yml
+++ b/dist/ssa/srs/ssa___attempt_to_disable_services.yml
@@ -51,6 +51,7 @@ tags:
   - process_path
   - dest_user_id
   - process
+  risk_score: 36
   security_domain: endpoint
   risk_severity: low
 test:
diff --git a/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml b/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml
index 8b42b91453..444dc103ae 100644
--- a/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml
+++ b/dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml
@@ -47,6 +47,7 @@ tags:
   - dest_user_id
   - process
   - cmd_line
+  risk_score: 63
   security_domain: endpoint
   risk_severity: medium
 test:
diff --git a/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml b/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml
index 7ab53c507b..8613482410 100644
--- a/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml
+++ b/dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml
@@ -44,6 +44,7 @@ tags:
   - dest_user_id
   - process
   - cmd_line
+  risk_score: 80
   security_domain: endpoint
   risk_severity: high
 test:
diff --git a/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml b/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml
index b068b2917e..9d6a6d9d0e 100644
--- a/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml
+++ b/dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml
@@ -51,6 +51,7 @@ tags:
   - Processes.parent_process_path
   - Processes.process_path
   - Processes.parent_process_id
+  risk_score: 90
   security_domain: endpoint
   risk_severity: high
 test:
diff --git a/dist/ssa/srs/ssa___delete_a_net_user.yml b/dist/ssa/srs/ssa___delete_a_net_user.yml
index 2217216c2c..b5436bb823 100644
--- a/dist/ssa/srs/ssa___delete_a_net_user.yml
+++ b/dist/ssa/srs/ssa___delete_a_net_user.yml
@@ -50,6 +50,7 @@ tags:
   - dest_user_id
   - process
   - cmd_line
+  risk_score: 49
   security_domain: endpoint
   risk_severity: low
 test:
diff --git a/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml b/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml
index 29c9a012d1..71f24d112a 100644
--- a/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml
+++ b/dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml
@@ -47,6 +47,7 @@ tags:
   - dest_user_id
   - process
   - cmd_line
+  risk_score: 35
   security_domain: endpoint
   risk_severity: low
 test:
diff --git a/dist/ssa/srs/ssa___detect_dump_lsass_memory_using_comsvcs.yml b/dist/ssa/srs/ssa___detect_dump_lsass_memory_using_comsvcs.yml
index 449ccca1b0..0dcc8fa489 100644
--- a/dist/ssa/srs/ssa___detect_dump_lsass_memory_using_comsvcs.yml
+++ b/dist/ssa/srs/ssa___detect_dump_lsass_memory_using_comsvcs.yml
@@ -41,6 +41,7 @@ tags:
   - _time
   - dest_device_id
   - process
+  risk_score: 70
   security_domain: endpoint
   risk_severity: medium
 test:
diff --git a/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml b/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml
index c61e45042e..e2323fffa2 100644
--- a/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml
+++ b/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml
@@ -49,6 +49,7 @@ tags:
   - dest_device_id
   - dest_user_id
   - cmd_line
+  risk_score: 35
   security_domain: endpoint
   risk_severity: low
 test:
diff --git a/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml b/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml
index 86cd481727..202e92675d 100644
--- a/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml
+++ b/dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml
@@ -54,6 +54,7 @@ tags:
   - dest_user_id
   - process
   - cmd_line
+  risk_score: 35
   security_domain: endpoint
   risk_severity: low
 test:
diff --git a/dist/ssa/srs/ssa___disable_net_user_account.yml b/dist/ssa/srs/ssa___disable_net_user_account.yml
index 547279b582..d2cac833f6 100644
--- a/dist/ssa/srs/ssa___disable_net_user_account.yml
+++ b/dist/ssa/srs/ssa___disable_net_user_account.yml
@@ -51,6 +51,7 @@ tags:
   - dest_user_id
   - process
   - cmd_line
+  risk_score: 49
   security_domain: endpoint
   risk_severity: low
 test:
diff --git a/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml b/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml
index 0db340530b..88fa49daae 100644
--- a/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml
+++ b/dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml
@@ -34,8 +34,8 @@ tags:
   analytic_story:
   - Suspicious DNS Traffic
   - Dynamic DNS
-  - Command & Control
   - Data Exfiltration
+  - Command and Control
   cis20: []
   kill_chain_phases:
   - Exploitation
@@ -51,6 +51,7 @@ tags:
   - dest_user_id
   - process
   - cmd_line
+  risk_score: 72
   security_domain: endpoint
   risk_severity: medium
 test:
diff --git a/dist/ssa/srs/ssa___fsutil_zeroing_file.yml b/dist/ssa/srs/ssa___fsutil_zeroing_file.yml
index 0c1c3bb568..203e1f5c4b 100644
--- a/dist/ssa/srs/ssa___fsutil_zeroing_file.yml
+++ b/dist/ssa/srs/ssa___fsutil_zeroing_file.yml
@@ -43,6 +43,7 @@ tags:
   - dest_user_id
   - process
   - cmd_line
+  risk_score: 54
   security_domain: endpoint
   risk_severity: medium
 test:
diff --git a/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml b/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml
index b037795f9f..1c3841d8e4 100644
--- a/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml
+++ b/dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml
@@ -47,6 +47,7 @@ tags:
   - dest_user_id
   - process
   - cmd_line
+  risk_score: 35
   security_domain: endpoint
   risk_severity: low
 test:
diff --git a/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml b/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml
index d4bbf1d5aa..e0a9b5940e 100644
--- a/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml
+++ b/dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml
@@ -44,6 +44,7 @@ tags:
   - PR.IP
   required_fields:
   - _time
+  risk_score: 72
   security_domain: endpoint
   risk_severity: medium
 test:
diff --git a/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml b/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml
index 1d5b1fabca..d31616dc32 100644
--- a/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml
+++ b/dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml
@@ -50,6 +50,7 @@ tags:
   - dest_user_id
   - process
   - cmd_line
+  risk_score: 35
   security_domain: endpoint
   risk_severity: low
 test:
diff --git a/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml b/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml
index d0f8bf116e..8d4dcab56f 100644
--- a/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml
+++ b/dist/ssa/srs/ssa___resize_shadowstorage_volume.yml
@@ -50,6 +50,7 @@ tags:
   - dest_user_id
   - process
   - cmd_line
+  risk_score: 64
   security_domain: endpoint
   risk_severity: medium
 test:
diff --git a/dist/ssa/srs/ssa___sdelete_application_execution.yml b/dist/ssa/srs/ssa___sdelete_application_execution.yml
index 4d6b945ed1..de7c563f9b 100644
--- a/dist/ssa/srs/ssa___sdelete_application_execution.yml
+++ b/dist/ssa/srs/ssa___sdelete_application_execution.yml
@@ -59,6 +59,7 @@ tags:
   - process_id
   - process_path
   - cmd_line
+  risk_score: 42
   security_domain: endpoint
   risk_severity: low
 test:
diff --git a/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml b/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml
index f96f630ae5..cd38084f56 100644
--- a/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml
+++ b/dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml
@@ -246,6 +246,7 @@ tags:
   - _time
   - dest_user_id
   - process_path
+  risk_score: 56
   security_domain: endpoint
   risk_severity: medium
 test:
diff --git a/dist/ssa/srs/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml b/dist/ssa/srs/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml
index 1ba0316e93..0441ccafe6 100644
--- a/dist/ssa/srs/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml
+++ b/dist/ssa/srs/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml
@@ -48,6 +48,7 @@ tags:
   - dest_user_id
   - process
   - cmd_line
+  risk_score: 35
   security_domain: network
   risk_severity: low
 test:
diff --git a/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml b/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml
index 7d6fada37f..6af7c5e32c 100644
--- a/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml
+++ b/dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml
@@ -48,6 +48,7 @@ tags:
   - dest_user_id
   - process
   - cmd_line
+  risk_score: 15
   security_domain: endpoint
   risk_severity: low
 test:
diff --git a/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml b/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml
index 2e461702b1..ff2f683048 100644
--- a/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml
+++ b/dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml
@@ -52,6 +52,7 @@ tags:
   - process_path
   - dest_user_id
   - process
+  risk_score: 63
   security_domain: endpoint
   risk_severity: medium
 test:
diff --git a/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml b/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml
index 635099699f..f94fc8ee9c 100644
--- a/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml
+++ b/dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml
@@ -48,6 +48,7 @@ tags:
   - process_path
   - dest_user_id
   - process
+  risk_score: 63
   security_domain: endpoint
   risk_severity: medium
 test:
diff --git a/dist/ssa/srs/ssa___windows_bits_job_persistence.yml b/dist/ssa/srs/ssa___windows_bits_job_persistence.yml
index e74510cc1b..c49263e82e 100644
--- a/dist/ssa/srs/ssa___windows_bits_job_persistence.yml
+++ b/dist/ssa/srs/ssa___windows_bits_job_persistence.yml
@@ -55,6 +55,7 @@ tags:
   - dest_user_id
   - process
   - cmd_line
+  risk_score: 56
   security_domain: endpoint
   risk_severity: medium
 test:
diff --git a/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml b/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml
index 618b60249e..817a0573d7 100644
--- a/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml
+++ b/dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml
@@ -59,6 +59,7 @@ tags:
   - dest_user_id
   - process
   - cmd_line
+  risk_score: 49
   security_domain: endpoint
   risk_severity: low
 test:
diff --git a/dist/ssa/srs/ssa___windows_certutil_decode_file.yml b/dist/ssa/srs/ssa___windows_certutil_decode_file.yml
index a66da327f2..26a4e9e2c6 100644
--- a/dist/ssa/srs/ssa___windows_certutil_decode_file.yml
+++ b/dist/ssa/srs/ssa___windows_certutil_decode_file.yml
@@ -53,6 +53,7 @@ tags:
   - dest_user_id
   - process
   - cmd_line
+  risk_score: 40
   security_domain: endpoint
   risk_severity: low
 test:
diff --git a/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml b/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml
index 6f90885e09..cf7dbfc9fe 100644
--- a/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml
+++ b/dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml
@@ -50,6 +50,7 @@ tags:
   - dest_user_id
   - process
   - cmd_line
+  risk_score: 90
   security_domain: endpoint
   risk_severity: high
 test:
diff --git a/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml b/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml
index 5ebeb7e74f..289ffd16f8 100644
--- a/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml
+++ b/dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml
@@ -51,6 +51,7 @@ tags:
   - dest_user_id
   - process
   - cmd_line
+  risk_score: 90
   security_domain: endpoint
   risk_severity: high
 test:
diff --git a/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml b/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml
index 89f7971a3b..5fcfaa9bec 100644
--- a/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml
+++ b/dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml
@@ -62,6 +62,7 @@ tags:
   - dest_user_id
   - process
   - cmd_line
+  risk_score: 80
   security_domain: endpoint
   risk_severity: high
 test:
diff --git a/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml b/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml
index bf3e0e467f..b146bf22e9 100644
--- a/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml
+++ b/dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml
@@ -47,6 +47,7 @@ tags:
   - dest_user_id
   - process
   - cmd_line
+  risk_score: 49
   security_domain: endpoint
   risk_severity: low
 test:
diff --git a/dist/ssa/srs/ssa___windows_eventvwr_uac_bypass.yml b/dist/ssa/srs/ssa___windows_eventvwr_uac_bypass.yml
index f85e8c20f6..b700b3fb03 100644
--- a/dist/ssa/srs/ssa___windows_eventvwr_uac_bypass.yml
+++ b/dist/ssa/srs/ssa___windows_eventvwr_uac_bypass.yml
@@ -56,6 +56,7 @@ tags:
   - registry_value_type
   - registry_value_data
   - process_guid
+  risk_score: 80
   security_domain: endpoint
   risk_severity: high
 test:
diff --git a/dist/ssa/srs/ssa___windows_mshta_child_process.yml b/dist/ssa/srs/ssa___windows_mshta_child_process.yml
index b19a18915a..e4a86803d8 100644
--- a/dist/ssa/srs/ssa___windows_mshta_child_process.yml
+++ b/dist/ssa/srs/ssa___windows_mshta_child_process.yml
@@ -53,6 +53,7 @@ tags:
   - dest_user_id
   - process
   - cmd_line
+  risk_score: 80
   security_domain: endpoint
   risk_severity: high
 test:
diff --git a/dist/ssa/srs/ssa___windows_mshta_command_line_url.yml b/dist/ssa/srs/ssa___windows_mshta_command_line_url.yml
index 17655034aa..065c2c4c90 100644
--- a/dist/ssa/srs/ssa___windows_mshta_command_line_url.yml
+++ b/dist/ssa/srs/ssa___windows_mshta_command_line_url.yml
@@ -55,6 +55,7 @@ tags:
   - dest_user_id
   - process
   - cmd_line
+  risk_score: 80
   security_domain: endpoint
   risk_severity: high
 test:
diff --git a/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml b/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml
index 36cad740cd..783f2f883f 100644
--- a/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml
+++ b/dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml
@@ -53,6 +53,7 @@ tags:
   - dest_user_id
   - process
   - cmd_line
+  risk_score: 80
   security_domain: endpoint
   risk_severity: high
 test:
diff --git a/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml
index d5ef0ec62c..4dfe024d7d 100644
--- a/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml
+++ b/dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml
@@ -62,6 +62,7 @@ tags:
   - dest_user_id
   - process
   - cmd_line
+  risk_score: 35
   security_domain: endpoint
   risk_severity: low
 test:
diff --git a/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml b/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml
index 3c21f70eeb..1e640f6906 100644
--- a/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml
+++ b/dist/ssa/srs/ssa___windows_powershell_downloadfile.yml
@@ -55,6 +55,7 @@ tags:
   - dest_user_id
   - process
   - cmd_line
+  risk_score: 35
   security_domain: endpoint
   risk_severity: low
 test:
diff --git a/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml b/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml
index 26f88372cf..581d1ac0d8 100644
--- a/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml
+++ b/dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml
@@ -51,6 +51,7 @@ tags:
   - dest_user_id
   - process
   - cmd_line
+  risk_score: 49
   security_domain: endpoint
   risk_severity: low
 test:
diff --git a/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml b/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml
index 4fd68ed7b6..ef9827d8bd 100644
--- a/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml
+++ b/dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml
@@ -51,6 +51,7 @@ tags:
   - dest_user_id
   - process
   - cmd_line
+  risk_score: 80
   security_domain: endpoint
   risk_severity: high
 test:
diff --git a/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml b/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml
index 5051572b45..88a090bba3 100644
--- a/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml
+++ b/dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml
@@ -56,6 +56,7 @@ tags:
   - dest_user_id
   - process
   - cmd_line
+  risk_score: 56
   security_domain: endpoint
   risk_severity: medium
 test: