Merge branch 'develop' into dependabot/pip/pyjwt-2.1.0

2026-06-08 17:32:49 +00:00 · 2021-05-17 15:21:05 -04:00
parent a729969172 e80bc45423
commit eb4dbb56d9
60 changed files with 104432 additions and 76284 deletions
@@ -32,6 +32,9 @@ references:
 tags:
  analytic_story:
  - Trickbot
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log
  kill_chain_phases:
  - Exploitation
  mitre_attack_id:
@@ -51,6 +54,3 @@ tags:
  - Processes.dest
  - Processes.user
  security_domain: endpoint
-  automated_detection_testing: passed
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log
@@ -7,8 +7,8 @@ type: batch
 datamodel:
 - Endpoint
 description: This analytic detects a potential process using COM Object like CMLUA
-  or CMSTPLUA to bypass UAC. This technique has been used by ransomware adversaries to gain administrative
-  privileges to its running process.
+  or CMSTPLUA to bypass UAC. This technique has been used by ransomware adversaries
+  to gain administrative privileges to its running process.
 search: '`sysmon` EventCode=7  ImageLoaded IN ("*\\CMLUA.dll", "*\\CMSTPLUA.dll",
  "*\\CMLUAUTIL.dll") NOT(process_name IN("CMSTP.exe", "CMMGR32.exe")) NOT(Image IN("*\\windows\\*",
  "*\\program files*")) | stats count min(_time) as firstTime max(_time) as lastTime
@@ -25,6 +25,9 @@ tags:
  analytic_story:
  - DarkSide Ransomware
  - Ransomware
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/darkside_cmstp_com/windows-sysmon.log
  kill_chain_phases:
  - Exploitation
  mitre_attack_id:
@@ -43,6 +46,3 @@ tags:
  - Signed
  - ProcessId
  security_domain: endpoint
-  automated_detection_testing: passed
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/darkside_cmstp_com/windows-sysmon.log
@@ -19,9 +19,9 @@ description: 'The following analytic identifies the use of default or publicly k
  connection, review and follow the connection back to identify any file modifications.'
 search: '`sysmon` EventID=17 OR EventID=18 PipeName IN (\\msagent_*, \\wkssvc*, \\DserNamePipe*,
  \\srvsvc_*, \\mojo.*, \\postex_*, \\status_*, \\MSSE-*, \\spoolss_*, \\win_svc*,
-  \\ntsvcs*, \\winsock*, \\UIA_PIPE*) | stats count min(_time) as firstTime max(_time) as lastTime
-  by Computer, process_name, process_id process_path, PipeName | rename Computer as
-  dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  \\ntsvcs*, \\winsock*, \\UIA_PIPE*) | stats count min(_time) as firstTime max(_time)
+  as lastTime by Computer, process_name, process_id process_path, PipeName | rename
+  Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
  | `cobalt_strike_named_pipes_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
  logs with the process name, parent process, and command-line executions from your
@@ -18,11 +18,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
  "*mega*", "*pcloud*", "*ftp*", "*--config*", "*--progress*", "*--no-check-certificate*",
  "*--ignore-existing*", "*--auto-confirm*", "*--transfers*", "*--multi-thread-streams*")  by
  Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process   Processes.process_id
-  Processes.parent_process_id 
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)`
-  |  `security_content_ctime(lastTime)`
-  | `detect_rclone_command_line_usage_filter`'
+  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  |  `security_content_ctime(lastTime)` | `detect_rclone_command_line_usage_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
  on process that include the name of the process responsible for the changes from
  your endpoints into the `Endpoint` datamodel in the `Processes` node.
@@ -36,6 +33,7 @@ tags:
  analytic_story:
  - DarkSide Ransomware
  - Ransomware
+  automated_detection_testing: passed
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1020/windows-sysmon.log
  kill_chain_phases:
@@ -56,4 +54,3 @@ tags:
  - Processes.process_id
  - Processes.parent_process_id
  security_domain: endpoint
-  automated_detection_testing: passed
@@ -14,9 +14,7 @@ description: The following analytic identifies the usage of `rclone.exe`, rename
 search: '`sysmon` EventID=1 OriginalFileName=rclone.exe NOT process_name=rclone.exe
  | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User,
  parent_process_name, process_name, OriginalFileName, process_path, CommandLine |
-  rename Computer as dest 
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)`
+  rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
  | `detect_renamed_rclone_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
  logs with the process name, parent process, and command-line executions from your
@@ -33,6 +31,7 @@ tags:
  analytic_story:
  - DarkSide Ransomware
  - Ransomware
+  automated_detection_testing: passed
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1020/windows-sysmon.log
  kill_chain_phases:
@@ -51,4 +50,3 @@ tags:
  - CommandLine
  - dest
  security_domain: endpoint
-  automated_detection_testing: passed
@@ -29,6 +29,7 @@ tags:
  analytic_story:
  - DarkSide Ransomware
  - Credential Dumping
+  automated_detection_testing: passed
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log
  kill_chain_phases:
@@ -49,4 +50,3 @@ tags:
  - Processes.process_id
  - Processes.parent_process_id
  security_domain: endpoint
-  automated_detection_testing: passed
@@ -11,18 +11,22 @@ description: 'The following analytic identifies one source endpoint failing to a
  represent an adversary performing a Password Spraying attack against an Active Directory
  environment using Kerberos to obtain initial access or elevate privileges. As attackers
  progress in a breach, mistakes will be made. In certain scenarios, adversaries may
-  execute a password spraying attack against disabled users. Event 4768 is generated every time
-  the Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT). Failure code `0x12` stands for
-  `clients credentials have been revoked` (account disabled, expired or locked out).\
+  execute a password spraying attack against disabled users. Event 4768 is generated
+  every time the Key Distribution Center issues a Kerberos Ticket Granting Ticket
+  (TGT). Failure code `0x12` stands for `clients credentials have been revoked` (account
+  disabled, expired or locked out).\

-  The detection calculates the standard deviation for each host and leverages 
-  the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, 
-  users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field.
-  This logic can be used for real time security monitoring as well as threat hunting exercises.\
+  The detection calculates the standard deviation for each host and leverages the
+  3-sigma statistical rule to identify an unusual number of users. To customize this
+  analytic, users can try different combinations of the `bucket` span time and the
+  calculation of the `upperBound` field. This logic can be used for real time security
+  monitoring as well as threat hunting exercises.\

-  This detection will only trigger on domain controllers, not on member servers or workstations.\
+  This detection will only trigger on domain controllers, not on member servers or
+  workstations.\

-  The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts.'
+  The analytics returned fields allow analysts to investigate the event further by
+  providing fields like source ip and attempted user accounts.'
 search: '`wineventlog_security` EventCode=4768 Account_Name!="*$" Result_Code=0x12
  | bucket span=2m _time | stats dc(Account_Name) AS unique_accounts values(Account_Name)
  as tried_accounts by _time, Client_Address | eventstats avg(unique_accounts) as
@@ -34,12 +38,16 @@ how_to_implement: To successfully implement this search, you need to be ingestin
  `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
 known_false_positives: A host failing to authenticate with multiple disabled domain
  users is not a common behavior for legitimate systems. Possible false positive scenarios
-  include but are not limited to vulnerability scanners, multi-user systems missconfigured systems.
+  include but are not limited to vulnerability scanners, multi-user systems missconfigured
+  systems.
 references:
 - https://attack.mitre.org/techniques/T1110/003/
 tags:
  analytic_story:
  - Active Directory Password Spraying
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_disabled_users_kerberos/windows-security.log
  kill_chain_phases:
  - Exploitation
  mitre_attack_id:
@@ -55,6 +63,3 @@ tags:
  - Account_Name
  - Client_Address
  security_domain: endpoint
-  automated_detection_testing: passed
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_disabled_users_kerberos/windows-security.log
@@ -11,18 +11,22 @@ description: 'The following analytic identifies one source endpoint failing to a
  represent an adversary performing a Password Spraying attack against an Active Directory
  environment using Kerberos to obtain initial access or elevate privileges. As attackers
  progress in a breach, mistakes will be made. In certain scenarios, adversaries may
-  execute a password spraying attack using an invalid list of users. Event 4768 is generated
-  every time the Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT).
-  Failure code 0x6 stands for `client not found in Kerberos database` (the attempted user is not a valid domain user).\
+  execute a password spraying attack using an invalid list of users. Event 4768 is
+  generated every time the Key Distribution Center issues a Kerberos Ticket Granting
+  Ticket (TGT). Failure code 0x6 stands for `client not found in Kerberos database`
+  (the attempted user is not a valid domain user).\

-  The detection calculates the standard deviation for each host and leverages 
-  the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, 
-  users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field.
-  This logic can be used for real time security monitoring as well as threat hunting exercises.\
+  The detection calculates the standard deviation for each host and leverages the
+  3-sigma statistical rule to identify an unusual number of users. To customize this
+  analytic, users can try different combinations of the `bucket` span time and the
+  calculation of the `upperBound` field. This logic can be used for real time security
+  monitoring as well as threat hunting exercises.\

-  This detection will only trigger on domain controllers, not on member servers or workstations.\
+  This detection will only trigger on domain controllers, not on member servers or
+  workstations.\

-  The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts.'
+  The analytics returned fields allow analysts to investigate the event further by
+  providing fields like source ip and attempted user accounts.'
 search: '`wineventlog_security` EventCode=4768 Result_Code=0x6 Account_Name!="*$"
  | bucket span=2m _time | stats dc(Account_Name) AS unique_accounts values(Account_Name)
  as tried_accounts by _time, Client_Address | eventstats avg(unique_accounts) as
@@ -34,12 +38,16 @@ how_to_implement: To successfully implement this search, you need to be ingestin
  `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
 known_false_positives: A host failing to authenticate with multiple invalid domain
  users is not a common behavior for legitimate systems. Possible false positive scenarios
-  include but are not limited to vulnerability scanners, multi-user systems and missconfigured systems.
+  include but are not limited to vulnerability scanners, multi-user systems and missconfigured
+  systems.
 references:
 - https://attack.mitre.org/techniques/T1110/003/
 tags:
  analytic_story:
  - Active Directory Password Spraying
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_kerberos/windows-security.log
  kill_chain_phases:
  - Exploitation
  mitre_attack_id:
@@ -55,6 +63,3 @@ tags:
  - Account_Name
  - Client_Address
  security_domain: endpoint
-  automated_detection_testing: passed
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_kerberos/windows-security.log
@@ -6,33 +6,42 @@ author: Mauricio Velazco, Splunk
 type: batch
 datamodel:
 - Endpoint
-description: 'The following analytic identifies one source endpoint failing to authenticate with multiple invalid users using the NTLM protocol. 
-  This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using NTLM to obtain 
-  initial access or elevate privileges. As attackers progress in a breach, mistakes will be made. In certain scenarios, adversaries may execute a password spraying attack using an invalid list of users.
-  Event 4776 is generated on the computer that is authoritative for the provided credentials. For domain accounts, the domain controller is authoritative.
-  For local accounts, the local computer is authoritative. Error code 0xC0000064 stands for `The username you typed does not exist` (the attempted user is a legitimate domain user).\
-  
-  The detection calculates the standard deviation for each host and leverages 
-  the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, 
-  users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field.
-  This logic can be used for real time security monitoring as well as threat hunting exercises.\
+description: 'The following analytic identifies one source endpoint failing to authenticate
+  with multiple invalid users using the NTLM protocol. This behavior could represent
+  an adversary performing a Password Spraying attack against an Active Directory environment
+  using NTLM to obtain initial access or elevate privileges. As attackers progress
+  in a breach, mistakes will be made. In certain scenarios, adversaries may execute
+  a password spraying attack using an invalid list of users. Event 4776 is generated
+  on the computer that is authoritative for the provided credentials. For domain accounts,
+  the domain controller is authoritative. For local accounts, the local computer is
+  authoritative. Error code 0xC0000064 stands for `The username you typed does not
+  exist` (the attempted user is a legitimate domain user).\

-  This detection will only trigger on domain controllers, not on member servers or workstations.\
+  The detection calculates the standard deviation for each host and leverages the
+  3-sigma statistical rule to identify an unusual number of users. To customize this
+  analytic, users can try different combinations of the `bucket` span time and the
+  calculation of the `upperBound` field. This logic can be used for real time security
+  monitoring as well as threat hunting exercises.\

-  The analytics returned fields allow analysts to investigate the event further by providing fields like source workstation name and attempted user accounts.'
-search: ' `wineventlog_security` EventCode=4776 Logon_Account!="*$" 0xC0000064 action=failure 
- | bucket span=2m _time
- | stats dc(Logon_Account) AS unique_accounts values(Logon_Account) as tried_accounts by _time, Source_Workstation
- | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Source_Workstation
- | eval upperBound=(comp_avg+comp_std*3)
- | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)
- | search isOutlier=1
- | `multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller events. The Advanced Security Audit policy setting `Audit Credential
+  This detection will only trigger on domain controllers, not on member servers or
+  workstations.\
+
+  The analytics returned fields allow analysts to investigate the event further by
+  providing fields like source workstation name and attempted user accounts.'
+search: ' `wineventlog_security` EventCode=4776 Logon_Account!="*$" 0xC0000064 action=failure
+  | bucket span=2m _time | stats dc(Logon_Account) AS unique_accounts values(Logon_Account)
+  as tried_accounts by _time, Source_Workstation | eventstats avg(unique_accounts)
+  as comp_avg , stdev(unique_accounts) as comp_std by Source_Workstation | eval upperBound=(comp_avg+comp_std*3)
+  | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)
+  | search isOutlier=1 | `multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  Domain Controller events. The Advanced Security Audit policy setting `Audit Credential
  Validation' within `Account Logon` needs to be enabled.
-known_false_positives: A host failing to authenticate with multiple invalid domain users is not a common behavior for legitimate systems. Possible false positive scenarios 
-  include but are not limited to vulnerability scanners and missconfigured systems. If this detection triggers on a host other than a Domain Controller, the behavior could 
-  represent a password spraying attack against the host's local accounts.
+known_false_positives: A host failing to authenticate with multiple invalid domain
+  users is not a common behavior for legitimate systems. Possible false positive scenarios
+  include but are not limited to vulnerability scanners and missconfigured systems.
+  If this detection triggers on a host other than a Domain Controller, the behavior
+  could represent a password spraying attack against the host's local accounts.
 references:
 - https://attack.mitre.org/techniques/T1110/003/
 - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-credential-validation
@@ -40,6 +49,9 @@ references:
 tags:
  analytic_story:
  - Active Directory Password Spraying
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_ntlm/windows-security.log
  kill_chain_phases:
  - Exploitation
  mitre_attack_id:
@@ -55,6 +67,3 @@ tags:
  - Logon_Account
  - Source_Workstation
  security_domain: endpoint
-  automated_detection_testing: passed
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_ntlm/windows-security.log
@@ -6,34 +6,43 @@ author: Mauricio Velazco, Splunk
 type: batch
 datamodel:
 - Endpoint
-description: 'The following analytic identifies a source user failing to authenticate with multiple users using explicit credentials on a host.
-  This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment to obtain initial access or elevate privileges.
-  Event 4648 is generated when a process attempts an account logon by explicitly specifying that accounts credentials. This event generates on domain controllers, member servers, and workstations.\
+description: 'The following analytic identifies a source user failing to authenticate
+  with multiple users using explicit credentials on a host. This behavior could represent
+  an adversary performing a Password Spraying attack against an Active Directory environment
+  to obtain initial access or elevate privileges. Event 4648 is generated when a process
+  attempts an account logon by explicitly specifying that accounts credentials. This
+  event generates on domain controllers, member servers, and workstations.\

-  The detection calculates the standard deviation for each host and leverages 
-  the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, 
-  users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field.
-  This logic can be used for real time security monitoring as well as threat hunting exercises.\
+  The detection calculates the standard deviation for each host and leverages the
+  3-sigma statistical rule to identify an unusual number of users. To customize this
+  analytic, users can try different combinations of the `bucket` span time and the
+  calculation of the `upperBound` field. This logic can be used for real time security
+  monitoring as well as threat hunting exercises.\

-  This detection will trigger on the potenfially malicious host, perhaps controlled via a trojan or operated by an insider threat, from where a password spraying attack is being executed.\
+  This detection will trigger on the potenfially malicious host, perhaps controlled
+  via a trojan or operated by an insider threat, from where a password spraying attack
+  is being executed.\

-  The analytics returned fields allow analysts to investigate the event further by providing fields like source account, attempted user accounts and the endpoint were the behavior was identified.'
-search: ' `wineventlog_security` EventCode=4648
- | bucket span=2m _time
- | eval Source_Account = mvindex(Account_Name, 0) 
- | eval Destination_Account = mvindex(Account_Name, 1) 
- | search Source_Account != "*$" Source_Account !="-" Destination_Account !="*$"
- | stats dc(Destination_Account) AS unique_accounts values(Destination_Account) as tried_account by _time, ComputerName, Source_Account
- | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by ComputerName
- | eval upperBound=(comp_avg+comp_std*3)
- | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)
- | search isOutlier=1
- | `multiple_users_attempting_to_authenticate_using_explicit_credentials_filter` '
-how_to_implement: To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers as 
-  well as member servers and workstations. The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs to be enabled.
-known_false_positives: A source user failing attempting to authenticate multiple users on a host is not a common behavior for regular systems. 
-  Some applications, however, may exhibit this behavior in which case sets of users hosts can be added to an allow list.
-  Possible false positive scenarios include systems where several users connect to like Mail servers, identity providers, remote desktop services, Citrix, etc.
+  The analytics returned fields allow analysts to investigate the event further by
+  providing fields like source account, attempted user accounts and the endpoint were
+  the behavior was identified.'
+search: ' `wineventlog_security` EventCode=4648 | bucket span=2m _time | eval Source_Account
+  = mvindex(Account_Name, 0) | eval Destination_Account = mvindex(Account_Name, 1)
+  | search Source_Account != "*$" Source_Account !="-" Destination_Account !="*$"
+  | stats dc(Destination_Account) AS unique_accounts values(Destination_Account) as
+  tried_account by _time, ComputerName, Source_Account | eventstats avg(unique_accounts)
+  as comp_avg , stdev(unique_accounts) as comp_std by ComputerName | eval upperBound=(comp_avg+comp_std*3)
+  | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)
+  | search isOutlier=1 | `multiple_users_attempting_to_authenticate_using_explicit_credentials_filter` '
+how_to_implement: To successfully implement this search, you need to be ingesting
+  Windows Event Logs from domain controllers as well as member servers and workstations.
+  The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs
+  to be enabled.
+known_false_positives: A source user failing attempting to authenticate multiple users
+  on a host is not a common behavior for regular systems. Some applications, however,
+  may exhibit this behavior in which case sets of users hosts can be added to an allow
+  list. Possible false positive scenarios include systems where several users connect
+  to like Mail servers, identity providers, remote desktop services, Citrix, etc.
 references:
 - https://attack.mitre.org/techniques/T1110/003/
 - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4648
@@ -41,6 +50,9 @@ references:
 tags:
  analytic_story:
  - Active Directory Password Spraying
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_explicit_credential_spray/windows-security.log
  kill_chain_phases:
  - Exploitation
  mitre_attack_id:
@@ -56,6 +68,3 @@ tags:
  - Account_Name
  - ComputerName
  security_domain: endpoint
-  automated_detection_testing: passed
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_explicit_credential_spray/windows-security.log
@@ -9,18 +9,22 @@ datamodel:
 description: 'The following analytic identifies one source endpoint failing to authenticate
  with multiple valid users using the Kerberos protocol. This behavior could represent
  an adversary performing a Password Spraying attack against an Active Directory environment
-  using Kerberos to obtain initial access or elevate privileges. Event 4771 is generated when 
-  the Key Distribution Center fails to issue a Kerberos Ticket Granting Ticket (TGT). Failure code 
-  0x18 stands for `wrong password provided` (the attempted user is a legitimate domain user).\
+  using Kerberos to obtain initial access or elevate privileges. Event 4771 is generated
+  when the Key Distribution Center fails to issue a Kerberos Ticket Granting Ticket
+  (TGT). Failure code 0x18 stands for `wrong password provided` (the attempted user
+  is a legitimate domain user).\

-  The detection calculates the standard deviation for each host and leverages 
-  the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, 
-  users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field.
-  This logic can be used for real time security monitoring as well as threat hunting exercises.\
+  The detection calculates the standard deviation for each host and leverages the
+  3-sigma statistical rule to identify an unusual number of users. To customize this
+  analytic, users can try different combinations of the `bucket` span time and the
+  calculation of the `upperBound` field. This logic can be used for real time security
+  monitoring as well as threat hunting exercises.\

-  This detection will only trigger on domain controllers, not on member servers or workstations.\
+  This detection will only trigger on domain controllers, not on member servers or
+  workstations.\

-  The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts.'
+  The analytics returned fields allow analysts to investigate the event further by
+  providing fields like source ip and attempted user accounts.'
 search: '`wineventlog_security` EventCode=4771 Failure_Code=0x18 Account_Name!="*$"
  | bucket span=2m _time | stats dc(Account_Name) AS unique_accounts values(Account_Name)
  as tried_accounts by _time, Client_Address | eventstats avg(unique_accounts) as
@@ -41,6 +45,9 @@ references:
 tags:
  analytic_story:
  - Active Directory Password Spraying
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_kerberos/windows-security.log
  kill_chain_phases:
  - Exploitation
  mitre_attack_id:
@@ -56,6 +63,3 @@ tags:
  - Account_Name
  - Client_Address
  security_domain: endpoint
-  automated_detection_testing: passed
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_kerberos/windows-security.log
@@ -9,20 +9,23 @@ datamodel:
 description: 'The following analytic identifies one source endpoint failing to authenticate
  with multiple valid users using the NTLM protocol. This behavior could represent
  an adversary performing a Password Spraying attack against an Active Directory environment
-  using NTLM to obtain initial access or elevate privileges. Event 4776 is generated on the 
-  computer that is authoritative for 
-  the provided credentials. For domain accounts, the domain controller is authoritative.
-  For local accounts, the local computer is authoritative. Error code 0xC000006A means:
-  misspelled or bad password (the attempted user is a legitimate domain user).\
+  using NTLM to obtain initial access or elevate privileges. Event 4776 is generated
+  on the computer that is authoritative for the provided credentials. For domain accounts,
+  the domain controller is authoritative. For local accounts, the local computer is
+  authoritative. Error code 0xC000006A means: misspelled or bad password (the attempted
+  user is a legitimate domain user).\

-  The detection calculates the standard deviation for each host and leverages 
-  the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, 
-  users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field.
-  This logic can be used for real time security monitoring as well as threat hunting exercises.\
+  The detection calculates the standard deviation for each host and leverages the
+  3-sigma statistical rule to identify an unusual number of users. To customize this
+  analytic, users can try different combinations of the `bucket` span time and the
+  calculation of the `upperBound` field. This logic can be used for real time security
+  monitoring as well as threat hunting exercises.\

-  This detection will only trigger on domain controllers, not on member servers or workstations.\
+  This detection will only trigger on domain controllers, not on member servers or
+  workstations.\

-  The analytics returned fields allow analysts to investigate the event further by providing fields like source workstation name and attempted user accounts.'
+  The analytics returned fields allow analysts to investigate the event further by
+  providing fields like source workstation name and attempted user accounts.'
 search: ' `wineventlog_security` EventCode=4776 Logon_Account!="*$" 0xC000006A action=failure
  | bucket span=2m _time | stats dc(Logon_Account) AS unique_accounts values(Logon_Account)
  as tried_accounts by _time, Source_Workstation | eventstats avg(unique_accounts)
@@ -44,6 +47,9 @@ references:
 tags:
  analytic_story:
  - Active Directory Password Spraying
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_ntlm/windows-security.log
  kill_chain_phases:
  - Exploitation
  mitre_attack_id:
@@ -59,6 +65,3 @@ tags:
  - Logon_Account
  - Source_Workstation
  security_domain: endpoint
-  automated_detection_testing: passed
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_valid_users_ntlm/windows-security.log
@@ -9,22 +9,23 @@ datamodel:
 description: 'The following analytic identifies a source process name failing to authenticate
  with multiple users. This behavior could represent an adversary performing a Password
  Spraying attack against an Active Directory environment to obtain initial access
-  or elevate privileges. Event 4625 generates
-  on domain controllers, member servers, and workstations when an account fails to logon. Logon Type 2 describes
-  an iteractive logon attempt.\
+  or elevate privileges. Event 4625 generates on domain controllers, member servers,
+  and workstations when an account fails to logon. Logon Type 2 describes an iteractive
+  logon attempt.\

-  The detection calculates the standard deviation for each host and leverages 
-  the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, 
-  users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field.
-  This logic can be used for real time security monitoring as well as threat hunting exercises.\
+  The detection calculates the standard deviation for each host and leverages the
+  3-sigma statistical rule to identify an unusual number of users. To customize this
+  analytic, users can try different combinations of the `bucket` span time and the
+  calculation of the `upperBound` field. This logic can be used for real time security
+  monitoring as well as threat hunting exercises.\

  This detection will trigger on the potenfially malicious host, perhaps controlled
  via a trojan or operated by an insider threat, from where a password spraying attack
  is being executed. This could be a domain controller as well as a member server
  or workstation.\

-  The analytics returned fields allow analysts to investigate the event further by providing fields like source process name, source account and attempted user
-  accounts.'
+  The analytics returned fields allow analysts to investigate the event further by
+  providing fields like source process name, source account and attempted user accounts.'
 search: ' `wineventlog_security` EventCode=4625 Logon_Type=2 Caller_Process_Name!="-"
  | bucket span=2m _time | eval Source_Account = mvindex(Account_Name, 0) | eval Destination_Account
  = mvindex(Account_Name, 1) | stats dc(Destination_Account) AS unique_accounts values(Account_Name)
@@ -48,6 +49,9 @@ references:
 tags:
  analytic_story:
  - Active Directory Password Spraying
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_multiple_users_from_process/windows-security.log
  kill_chain_phases:
  - Exploitation
  mitre_attack_id:
@@ -65,6 +69,3 @@ tags:
  - Account_Name
  - ComputerName
  security_domain: endpoint
-  automated_detection_testing: passed
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_multiple_users_from_process/windows-security.log
@@ -6,32 +6,40 @@ author: Mauricio Velazco, Splunk
 type: batch
 datamodel:
 - Endpoint
-description: The following analytic identifies a source host failing to authenticate against a remote host with multiple users. This behavior could represent an adversary
-  performing a Password Spraying attack against an Active Directory environment to obtain initial access or elevate privileges. 
-  Event 4625 documents each and every failed attempt to logon to the local computer. This event generates on domain controllers, member servers, and workstations. Logon Type 3 
-  describes an remote authentication attempt.\
+description: 'The following analytic identifies a source host failing to authenticate
+  against a remote host with multiple users. This behavior could represent an adversary
+  performing a Password Spraying attack against an Active Directory environment to
+  obtain initial access or elevate privileges. Event 4625 documents each and every
+  failed attempt to logon to the local computer. This event generates on domain controllers,
+  member servers, and workstations. Logon Type 3 describes an remote authentication
+  attempt.\

-  The detection calculates the standard deviation for each host and leverages 
-  the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, 
-  users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field.
-  This logic can be used for real time security monitoring as well as threat hunting exercises.\
+  The detection calculates the standard deviation for each host and leverages the
+  3-sigma statistical rule to identify an unusual number of users. To customize this
+  analytic, users can try different combinations of the `bucket` span time and the
+  calculation of the `upperBound` field. This logic can be used for real time security
+  monitoring as well as threat hunting exercises.\

-  This detection will trigger on the host that is the target of the password spraying attack. This could be a domain controller as well as a member server or workstation.\
+  This detection will trigger on the host that is the target of the password spraying
+  attack. This could be a domain controller as well as a member server or workstation.\

-  The analytics returned fields allow analysts to investigate the event further by providing fields like source process name, source account and attempted user accounts.
+  The analytics returned fields allow analysts to investigate the event further by
+  providing fields like source process name, source account and attempted user accounts.'
 search: ' `wineventlog_security` EventCode=4625 Logon_Type=3 Source_Network_Address!="-"
- | bucket span=2m _time
- | eval Destination_Account = mvindex(Account_Name, 1) 
- | stats dc(Destination_Account) AS unique_accounts values(Destination_Account) as tried_accounts by _time, Source_Network_Address, ComputerName
- | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Source_Network_Address, ComputerName
- | eval upperBound=(comp_avg+comp_std*3)
- | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)
- | search isOutlier=1
- | `multiple_users_remotely_failing_to_authenticate_from_host_filter` ' 
-how_to_implement: To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers as 
-  as well as member servers and workstations. The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs to be enabled.
-known_false_positives: A host failing to authenticate with multiple valid users against a remote host is not a common behavior for legitimate systems. 
-  Possible false positive scenarios include but are not limited to vulnerability scanners, remote administration tools, missconfigyred systems, etc.
+  | bucket span=2m _time | eval Destination_Account = mvindex(Account_Name, 1) | stats
+  dc(Destination_Account) AS unique_accounts values(Destination_Account) as tried_accounts
+  by _time, Source_Network_Address, ComputerName | eventstats avg(unique_accounts)
+  as comp_avg , stdev(unique_accounts) as comp_std by Source_Network_Address, ComputerName
+  | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10
+  and unique_accounts >= upperBound, 1, 0) | search isOutlier=1 | `multiple_users_remotely_failing_to_authenticate_from_host_filter` '
+how_to_implement: To successfully implement this search, you need to be ingesting
+  Windows Event Logs from domain controllers as as well as member servers and workstations.
+  The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs
+  to be enabled.
+known_false_positives: A host failing to authenticate with multiple valid users against
+  a remote host is not a common behavior for legitimate systems. Possible false positive
+  scenarios include but are not limited to vulnerability scanners, remote administration
+  tools, missconfigyred systems, etc.
 references:
 - https://attack.mitre.org/techniques/T1110/003/
 - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625
@@ -40,6 +48,9 @@ references:
 tags:
  analytic_story:
  - Active Directory Password Spraying
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_remote_spray/windows-security.log
  kill_chain_phases:
  - Exploitation
  mitre_attack_id:
@@ -57,6 +68,3 @@ tags:
  - ComputerName
  - Source_Network_Address
  security_domain: endpoint
-  automated_detection_testing: passed
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_remote_spray/windows-security.log
@@ -13,10 +13,9 @@ description: this detection was designed to identifies suspicious spawned proces
 search: '| tstats `security_content_summariesonly` count values(Processes.process)
  min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
  where (Processes.parent_process_name = "winword.exe" OR Processes.parent_process_name
-  = "excel.exe" OR Processes.parent_process_name = "powerpnt.exe") 
-  Processes.process_name=rundll32.exe  by Processes.parent_process
-  Processes.process_name Processes.process_id Processes.process_guid Processes.user
-  Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`
+  = "excel.exe" OR Processes.parent_process_name = "powerpnt.exe") Processes.process_name=rundll32.exe  by
+  Processes.parent_process Processes.process_name Processes.process_id Processes.process_guid
+  Processes.user Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`
  | `office_application_spawn_rundll32_process_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
  logs with the process name, parent process, and command-line executions from your
@@ -19,11 +19,11 @@ description: this search detects a potential malicious office document that crea
  source. Was it schtasks.exe or via TaskService? Review the job created and the Command
  to be executed. Capture any artifacts on disk and review. Identify any parallel
  processes within the same timeframe to identify source.'
-search: '`sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE") 
-  ImageLoaded = "*\\taskschd.dll" | stats min(_time) as firstTime
-  max(_time) as lastTime values(ImageLoaded) as AllImageLoaded count by Computer EventCode
-  Image process_name ProcessId ProcessGuid | `security_content_ctime(firstTime)` |
-  `security_content_ctime(lastTime)` | `office_document_creating_schedule_task_filter`'
+search: '`sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE")
+  ImageLoaded = "*\\taskschd.dll" | stats min(_time) as firstTime max(_time) as lastTime
+  values(ImageLoaded) as AllImageLoaded count by Computer EventCode Image process_name
+  ProcessId ProcessGuid | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `office_document_creating_schedule_task_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
  logs with the process name and ImageLoaded (Like sysmon EventCode 7) from your endpoints.
  If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
@@ -13,10 +13,10 @@ description: this detection was designed to identifies suspicious office documen
  or other malware component. It is really good practice to disable macro by default
  to avoid automatically execute macro code while opening or closing a office document
  files.
-search: '`sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE")  
-  ImageLoaded IN ("*\\VBE7INTL.DLL","*\\VBE7.DLL", "*\\VBEUI.DLL")
-  | stats min(_time) as firstTime max(_time) as lastTime values(ImageLoaded) as AllImageLoaded
-  count by Computer EventCode Image process_name ProcessId ProcessGuid | `security_content_ctime(firstTime)`
+search: '`sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE")
+  ImageLoaded IN ("*\\VBE7INTL.DLL","*\\VBE7.DLL", "*\\VBEUI.DLL") | stats min(_time)
+  as firstTime max(_time) as lastTime values(ImageLoaded) as AllImageLoaded count
+  by Computer EventCode Image process_name ProcessId ProcessGuid | `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)` | `office_document_executing_macro_code_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
  logs with the process name and ImageLoaded (Like sysmon EventCode 7) from your endpoints.
@@ -27,6 +27,9 @@ references:
 tags:
  analytic_story:
  - Trickbot
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log
  kill_chain_phases:
  - Exploitation
  mitre_attack_id:
@@ -48,6 +51,3 @@ tags:
  - Computer
  - EventCode
  security_domain: endpoint
-  automated_detection_testing: passed
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log
@@ -46,4 +46,4 @@ tags:
  - Computer
  - Image
  - user
-  security_domain: endpoint
+  security_domain: endpoint
@@ -4,8 +4,8 @@ version: 5
 date: '2020-11-27'
 author: David Dorsey, Splunk
 type: batch
-datamodel: 
-  - Endpoint
+datamodel:
+- Endpoint
 description: The search looks for modifications to registry keys that can be used
  to launch an application or service at system startup.
 search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name)
@@ -35,6 +35,9 @@ tags:
  analytic_story:
  - Windows Persistence Techniques
  - Trickbot
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/tasksched/windows-security.log
  kill_chain_phases:
  - Exploitation
  mitre_attack_id:
@@ -53,6 +56,3 @@ tags:
  - Hidden
  - Arguments
  security_domain: endpoint
-  automated_detection_testing: passed
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/tasksched/windows-security.log
@@ -16,11 +16,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=slui.exe
  (Processes.process=*-verb* Processes.process=*runas*) by Processes.dest Processes.user
  Processes.parent_process Processes.process_name Processes.process Processes.process_id
-  Processes.parent_process_id 
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`
-  | `slui_runas_elevated_filter`'
+  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `slui_runas_elevated_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
  on process that include the name of the process responsible for the changes from
  your endpoints into the `Endpoint` datamodel in the `Processes` node.
@@ -36,6 +33,7 @@ tags:
  analytic_story:
  - DarkSide Ransomware
  - Windows Defense Evasion Tactics
+  automated_detection_testing: passed
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/slui/windows-sysmon.log
  kill_chain_phases:
@@ -56,4 +54,3 @@ tags:
  - Processes.process_id
  - Processes.parent_process_id
  security_domain: endpoint
-  automated_detection_testing: passed
@@ -16,11 +16,8 @@ description: The following analytic identifies the Microsoft Software Licensing
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=slui.exe
  by Processes.dest Processes.user Processes.parent_process Processes.process_name
-  Processes.process Processes.process_id Processes.parent_process_id 
-  | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)` 
-  | `slui_spawning_a_process_filter`'
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `slui_spawning_a_process_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
  on process that include the name of the process responsible for the changes from
  your endpoints into the `Endpoint` datamodel in the `Processes` node.
@@ -34,6 +31,7 @@ tags:
  analytic_story:
  - DarkSide Ransomware
  - Windows Defense Evasion Tactics
+  automated_detection_testing: passed
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/slui/windows-sysmon.log
  kill_chain_phases:
@@ -54,4 +52,3 @@ tags:
  - Processes.process_id
  - Processes.parent_process_id
  security_domain: endpoint
-  automated_detection_testing: passed
@@ -23,6 +23,9 @@ references:
 tags:
  analytic_story:
  - Trickbot
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/namedpipe/windows-sysmon.log
  kill_chain_phases:
  - Exploitation
  mitre_attack_id:
@@ -41,6 +44,3 @@ tags:
  - Image
  - process_id
  security_domain: endpoint
-  automated_detection_testing: passed
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/namedpipe/windows-sysmon.log
@@ -31,6 +31,9 @@ references:
 tags:
  analytic_story:
  - Trickbot
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log
  kill_chain_phases:
  - Exploitation
  mitre_attack_id:
@@ -50,6 +53,3 @@ tags:
  - Computer
  - EventCode
  security_domain: endpoint
-  automated_detection_testing: passed
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log
@@ -27,6 +27,9 @@ references:
 tags:
  analytic_story:
  - Trickbot
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log
  kill_chain_phases:
  - Exploitation
  mitre_attack_id:
@@ -44,6 +47,3 @@ tags:
  - EventCode
  - ProcessId
  security_domain: endpoint
-  automated_detection_testing: passed
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log
@@ -28,6 +28,9 @@ references:
 tags:
  analytic_story:
  - Trickbot
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log
  kill_chain_phases:
  - Exploitation
  mitre_attack_id:
@@ -47,6 +50,3 @@ tags:
  - Processes.dest
  - Processes.user
  security_domain: endpoint
-  automated_detection_testing: passed
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log
@@ -25,6 +25,9 @@ references:
 tags:
  analytic_story:
  - Trickbot
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/exe_smbshare/windows-security.log
  kill_chain_phases:
  - Lateral Movement
  mitre_attack_id:
@@ -44,6 +47,3 @@ tags:
  - src_port
  - Source_Address
  security_domain: endpoint
-  automated_detection_testing: passed
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/exe_smbshare/windows-security.log
@@ -6,16 +6,18 @@ author: Teoderick Contreras, Splunk
 type: batch
 datamodel:
 - Endpoint
-description: This following analytic detects PowerShell command to delete shadow copy using the WMIC PowerShell module.
-  This technique was seen used by a recent adversary to deploy DarkSide Ransomware where it executed a child process of PowerShell to execute a hex encoded
-  command to delete shadow copy. This hex encoded command was able to be decrypted by PowerShell log.
-search: '`powershell` EventCode=4104 Message= "*ShadowCopy*" Message = "*Delete*" 
-| stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User 
-| `security_content_ctime(firstTime)` 
-| `security_content_ctime(lastTime)` 
-| `delete_shadowcopy_with_powershell_filter`'
+description: This following analytic detects PowerShell command to delete shadow copy
+  using the WMIC PowerShell module. This technique was seen used by a recent adversary
+  to deploy DarkSide Ransomware where it executed a child process of PowerShell to
+  execute a hex encoded command to delete shadow copy. This hex encoded command was
+  able to be decrypted by PowerShell log.
+search: '`powershell` EventCode=4104 Message= "*ShadowCopy*" Message = "*Delete*"
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
+  ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `delete_shadowcopy_with_powershell_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the powershell logs  from your endpoints. make sure you enable needed registry to monitor this event.
+  logs with the powershell logs  from your endpoints. make sure you enable needed
+  registry to monitor this event.
 known_false_positives: unknown
 references:
 - https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html
@@ -5,7 +5,7 @@
    "id": {
      "group": null, 
      "name": "DA-ESS-ContentUpdate", 
-      "version": "3.20.0"
+      "version": "3.21.0"
    }, 
    "author": [
      {
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-04-29T21:10:45 UTC
+# On Date: 2021-05-13T21:46:44 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -35,8 +35,8 @@ version = 1
 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
 detection_searches = ["ESCU - Abnormally High AWS Instances Launched by User - MLTK - Rule", "ESCU - Abnormally High AWS Instances Launched by User - Rule", "ESCU - EC2 Instance Started In Previously Unseen Region - Rule", "ESCU - EC2 Instance Started With Previously Unseen AMI - Rule", "ESCU - EC2 Instance Started With Previously Unseen Instance Type - Rule", "ESCU - EC2 Instance Started With Previously Unseen User - Rule"]
 mappings = {"cis20": ["CIS 1", "CIS 12", "CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1535"], "nist": ["DE.AE", "DE.DP", "ID.AM"]}
-investigative_searches = ["ESCU - Get EC2 Launch Details - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task"]
-support_searches = ["ESCU - Baseline of Excessive AWS Instances Launched by User - MLTK", "ESCU - Previously Seen EC2 AMIs", "ESCU - Previously Seen AWS Regions", "ESCU - Previously Seen EC2 Launches By User", "ESCU - Previously Seen EC2 Instance Types"]
+investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"]
+support_searches = ["ESCU - Baseline of Excessive AWS Instances Launched by User - MLTK", "ESCU - Previously Seen AWS Regions", "ESCU - Previously Seen EC2 AMIs", "ESCU - Previously Seen EC2 Instance Types", "ESCU - Previously Seen EC2 Launches By User"]
 data_models = []
 providing_technologies = none
 description = Monitor your AWS EC2 instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or EC2 instances started by previously unseen users are just a few examples of potentially malicious behavior.
@@ -73,7 +73,7 @@ version = 2
 reference = ["https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Appendix_NACLs.html", "https://aws.amazon.com/blogs/security/how-to-help-prepare-for-ddos-attacks-by-reducing-your-attack-surface/"]
 detection_searches = ["ESCU - AWS Network Access Control List Created with All Open Ports - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - Detect Spike in Network ACL Activity - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule"]
 mappings = {"cis20": ["CIS 11", "CIS 12"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1562.007"], "nist": ["DE.AE", "DE.CM", "DE.DP", "PR.AC"]}
-investigative_searches = ["ESCU - Get DNS traffic ratio - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get DNS Server History for a host - Response Task"]
+investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"]
 support_searches = ["ESCU - Baseline of Network ACL Activity by ARN", "ESCU - Baseline of blocked outbound traffic from AWS"]
 data_models = []
 providing_technologies = none
@@ -107,7 +107,7 @@ version = 1
 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
 detection_searches = ["ESCU - AWS Cloud Provisioning From Previously Unseen City - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen Country - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen IP Address - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen Region - Rule"]
 mappings = {"cis20": ["CIS 1"], "mitre_attack": ["T1535"], "nist": ["ID.AM"]}
-investigative_searches = ["ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - Get All AWS Activity From Region - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From Country - Response Task", "ESCU - Get All AWS Activity From City - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"]
+investigative_searches = ["ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From City - Response Task", "ESCU - Get All AWS Activity From Country - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get All AWS Activity From Region - Response Task"]
 support_searches = ["ESCU - Previously Seen AWS Provisioning Activity Sources"]
 data_models = []
 providing_technologies = none
@@ -125,8 +125,8 @@ version = 1
 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://redlock.io/blog/cryptojacking-tesla"]
 detection_searches = ["ESCU - AWS Excessive Security Scanning - Rule", "ESCU - Detect API activity from users without MFA - Rule", "ESCU - Detect AWS API Activities From Unapproved Accounts - Rule", "ESCU - Detect Spike in AWS API Activity - Rule", "ESCU - Detect Spike in Security Group Activity - Rule", "ESCU - Detect new API calls from user roles - Rule"]
 mappings = {"cis20": ["CIS 1", "CIS 13", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1526"], "nist": ["DE.CM", "DE.DP", "ID.AM", "PR.AC", "PR.DS"]}
-investigative_searches = ["ESCU - Investigate AWS User Activities by user field - Response Task", "ESCU - Get Notable History - Response Task"]
-support_searches = ["ESCU - Create a list of approved AWS service accounts", "ESCU - Baseline of API Calls per User ARN", "ESCU - Baseline of Security Group Activity by ARN", "ESCU - Previously seen API call per user roles in CloudTrail"]
+investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS User Activities by user field - Response Task"]
+support_searches = ["ESCU - Baseline of API Calls per User ARN", "ESCU - Baseline of Security Group Activity by ARN", "ESCU - Create a list of approved AWS service accounts", "ESCU - Previously seen API call per user roles in CloudTrail"]
 data_models = []
 providing_technologies = none
 description = Detect and investigate dormant user accounts for your AWS environment that have become active again. Because inactive and ad-hoc accounts are common attack targets, it's critical to enable governance within your environment.
@@ -136,6 +136,25 @@ Fortunately, you can leverage Amazon Web Services (AWS) CloudTrail--a tool that
 The detection searches in this Analytic Story are designed to help you uncover AWS API activities from users not listed in the identity table, as well as similar activities from disabled accounts.
 product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']

+[Active Directory Password Spraying]
+category =  Adversary Tactics
+creation_date = 2021-04-07
+modification_date = 2021-04-07
+id = 3de109da-97d2-11eb-8b6a-acde48001122
+version = 1
+reference = ["https://attack.mitre.org/techniques/T1110/003/", "https://www.microsoft.com/security/blog/2020/04/23/protecting-organization-password-spray-attacks/", "https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn452415(v=ws.11)"]
+detection_searches = ["ESCU - Multiple Disabled Users Failing To Authenticate From Host Using Kerberos - Rule", "ESCU - Multiple Invalid Users Failing To Authenticate From Host Using Kerberos - Rule", "ESCU - Multiple Invalid Users Failing To Authenticate From Host Using NTLM - Rule", "ESCU - Multiple Users Attempting To Authenticate Using Explicit Credentials - Rule", "ESCU - Multiple Users Failing To Authenticate From Host Using Kerberos - Rule", "ESCU - Multiple Users Failing To Authenticate From Host Using NTLM - Rule", "ESCU - Multiple Users Failing To Authenticate From Process - Rule", "ESCU - Multiple Users Remotely Failing To Authenticate From Host - Rule"]
+mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"]}
+investigative_searches = []
+support_searches = []
+data_models = []
+providing_technologies = none
+description = Monitor for activities and techniques associated with Password Spraying attacks within Active Directory environments.
+narrative = In a password spraying attack, adversaries leverage one or a small list of commonly used / popular passwords against a large volume of usernames to acquire valid account credentials. Unlike a Brute Force attack that targets a specific user or small group of users with a large number of passwords, password spraying follows the opposite aproach and increases the chances of obtaining valid credentials while avoiding account lockouts. This allows adversaries to remain undetected if the target organization does not have the proper monitoring and detection controls in place.\
+Password Spraying can be leveraged by adversaries across different stages in an attack. It can be used to obtain an iniial access to an environment but can also be used to escalate privileges when access has been already achieved. In some scenarios, this technique capitalizes on a security policy most organizations implement, password rotation. As enterprise users change their passwords, it is possible some pick predictable, seasonal passwords such as `$CompanyNameWinter`, `Summer2021`, etc.\
+Specifically, this Analytic Story is focused on detecting possible Password Spraying attacks against Active Directory environments leveraging Windows Event Logs in the `Account Logon` and `Logon/Logoff` Advanced Audit Policy categories. It presents 9 detection analytics which can aid defenders in identifyng instances where one source user, source host or source process attempts to authenticate against a target or targets using a high, unsual, number of unique users. A user, host or process attempting to authenticate with multiple users is not common behavior for legitimate systems and should be monitored by security teams. Possible false positive scenarios include but are not limited to vulnerability scanners, remote administration tools, multi-user systems and missconfigured systems. These should be easily spotted when first implementing the detection and addded to an allow list or lookup table. The presented detections can also be used in Threat Hunting exercises.
+product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']
+
 [Apache Struts Vulnerability]
 category =  Vulnerability
 creation_date = 2018-12-06
@@ -145,7 +164,7 @@ version = 1
 reference = ["https://github.com/SpiderLabs/owasp-modsecurity-crs/blob/v3.2/dev/rules/REQUEST-944-APPLICATION-ATTACK-JAVA.conf"]
 detection_searches = ["ESCU - Suspicious Java Classes - Rule", "ESCU - Unusually Long Content-Type Length - Rule", "ESCU - Web Servers Executing Suspicious Processes - Rule"]
 mappings = {"cis20": ["CIS 12", "CIS 18", "CIS 3", "CIS 4", "CIS 7"], "kill_chain_phases": ["Actions on Objectives", "Delivery", "Exploitation"], "mitre_attack": ["T1082"], "nist": ["DE.AE", "DE.CM", "ID.RA", "PR.IP", "PR.MA", "PR.PT", "RS.MI"]}
-investigative_searches = ["ESCU - Investigate Web POSTs From src - Response Task", "ESCU - Investigate Suspicious Strings in HTTP Header - Response Task", "ESCU - Get Notable History - Response Task"]
+investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Investigate Suspicious Strings in HTTP Header - Response Task", "ESCU - Investigate Web POSTs From src - Response Task"]
 support_searches = []
 data_models = ["Endpoint"]
 providing_technologies = none
@@ -226,7 +245,7 @@ version = 1
 reference = ["https://www.zerofox.com/blog/what-is-digital-risk-monitoring/", "https://securingtomorrow.mcafee.com/consumer/family-safety/what-is-typosquatting/", "https://blog.malwarebytes.com/cybercrime/2016/06/explained-typosquatting/"]
 detection_searches = ["ESCU - Monitor DNS For Brand Abuse - Rule", "ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Monitor Web Traffic For Brand Abuse - Rule"]
 mappings = {"cis20": ["CIS 7"], "kill_chain_phases": ["Actions on Objectives", "Delivery"], "nist": ["PR.IP"]}
-investigative_searches = ["ESCU - Get Emails From Specific Sender - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Email Info - Response Task"]
+investigative_searches = ["ESCU - Get Email Info - Response Task", "ESCU - Get Emails From Specific Sender - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"]
 support_searches = ["ESCU - DNSTwist Domain Names"]
 data_models = ["Email", "Network_Resolution", "Web"]
 providing_technologies = none
@@ -262,8 +281,8 @@ version = 1
 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
 detection_searches = ["ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule", "ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule"]
 mappings = {"cis20": ["CIS 1", "CIS 12", "CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1535"], "nist": ["DE.AE", "DE.DP", "ID.AM"]}
-investigative_searches = ["ESCU - Get EC2 Launch Details - Response Task", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task"]
-support_searches = ["ESCU - Previously Seen Cloud Compute Images - Update", "ESCU - Baseline Of Cloud Instances Destroyed", "ESCU - Previously Seen Cloud Compute Creations By User - Initial", "ESCU - Previously Seen Cloud Regions - Update", "ESCU - Previously Seen Cloud Compute Creations By User - Update", "ESCU - Previously Seen Cloud Compute Instance Types - Update", "ESCU - Previously Seen Cloud Compute Images - Initial", "ESCU - Previously Seen Cloud Compute Instance Types - Initial", "ESCU - Previously Seen Cloud Regions - Initial", "ESCU - Baseline Of Cloud Instances Launched"]
+investigative_searches = ["ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"]
+support_searches = ["ESCU - Baseline Of Cloud Instances Destroyed", "ESCU - Baseline Of Cloud Instances Launched", "ESCU - Previously Seen Cloud Compute Creations By User - Initial", "ESCU - Previously Seen Cloud Compute Creations By User - Update", "ESCU - Previously Seen Cloud Compute Images - Initial", "ESCU - Previously Seen Cloud Compute Images - Update", "ESCU - Previously Seen Cloud Compute Instance Types - Initial", "ESCU - Previously Seen Cloud Compute Instance Types - Update", "ESCU - Previously Seen Cloud Regions - Initial", "ESCU - Previously Seen Cloud Regions - Update"]
 data_models = ["Change"]
 providing_technologies = none
 description = Monitor your cloud compute instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or compute instances started by previously unseen users are just a few examples of potentially malicious behavior.
@@ -325,7 +344,7 @@ version = 1
 reference = ["https://www.intego.com/mac-security-blog/osxcoldroot-and-the-rat-invasion/", "https://objective-see.com/blog/blog_0x2A.html", "https://www.bleepingcomputer.com/news/security/coldroot-rat-still-undetectable-despite-being-uploaded-on-github-two-years-ago/"]
 detection_searches = ["ESCU - Osquery pack - ColdRoot detection - Rule", "ESCU - Processes Tapping Keyboard Events - Rule"]
 mappings = {"cis20": ["CIS 4", "CIS 8"], "kill_chain_phases": ["Command and Control", "Installation"], "nist": ["DE.CM", "DE.DP", "PR.PT"]}
-investigative_searches = ["ESCU - Investigate Network Traffic From src ip - Response Task", "ESCU - Get Notable History - Response Task"]
+investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Investigate Network Traffic From src ip - Response Task"]
 support_searches = []
 data_models = []
 providing_technologies = none
@@ -344,7 +363,7 @@ version = 1
 reference = ["https://attack.mitre.org/wiki/Collection", "https://attack.mitre.org/wiki/Technique/T1074"]
 detection_searches = ["ESCU - Email files written outside of the Outlook directory - Rule", "ESCU - Email servers sending high volume traffic to hosts - Rule", "ESCU - Hosts receiving high volume of network traffic from email server - Rule", "ESCU - Suspicious writes to System Volume Information - Rule", "ESCU - Suspicious writes to windows Recycle Bin - Rule"]
 mappings = {"cis20": ["CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1036", "T1114.001", "T1114.002"], "nist": ["DE.AE", "DE.CM", "PR.PT"]}
-investigative_searches = ["ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"]
+investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
 support_searches = []
 data_models = ["Endpoint", "Network_Traffic"]
 providing_technologies = none
@@ -363,8 +382,8 @@ version = 1
 reference = ["https://attack.mitre.org/wiki/Command_and_Control", "https://searchsecurity.techtarget.com/feature/Command-and-control-servers-The-puppet-masters-that-govern-malware"]
 detection_searches = ["ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Detect Large Outbound ICMP Packets - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Multiple Archive Files Http Post Traffic - Rule", "ESCU - Plain HTTP POST Exfiltrated Data - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - TOR Traffic - Rule"]
 mappings = {"cis20": ["CIS 1", "CIS 11", "CIS 12", "CIS 13", "CIS 3", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery", "Exfiltration", "Exploitation"], "mitre_attack": ["T1048", "T1048.003", "T1071.001", "T1071.004", "T1095", "T1189"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.AC", "PR.DS", "PR.IP", "PR.PT"]}
-investigative_searches = ["ESCU - Get DNS traffic ratio - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get DNS Server History for a host - Response Task"]
-support_searches = ["ESCU - Baseline of blocked outbound traffic from AWS", "ESCU - Baseline of DNS Query Length - MLTK"]
+investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"]
+support_searches = ["ESCU - Baseline of DNS Query Length - MLTK", "ESCU - Baseline of blocked outbound traffic from AWS"]
 data_models = ["Endpoint", "Network_Resolution", "Network_Traffic"]
 providing_technologies = none
 description = Detect and investigate tactics, techniques, and procedures leveraged by attackers to establish and operate command and control channels. Implants installed by attackers on compromised endpoints use these channels to receive instructions and send data back to the malicious operators.
@@ -414,9 +433,9 @@ modification_date = 2020-02-04
 id = 854d78bf-d0e2-4f4e-b05c-640905f86d7a
 version = 3
 reference = ["https://attack.mitre.org/wiki/Technique/T1003", "https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html"]
-detection_searches = ["ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Creation of lsass Dump with Taskmgr - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule"]
-mappings = {"cis20": ["CIS 16", "CIS 3", "CIS 5", "CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Installation"], "mitre_attack": ["T1003.001", "T1003.002", "T1003.003", "T1059.001"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.IP"]}
-investigative_searches = ["ESCU - Investigate Pass the Ticket Attempts - Response Task", "ESCU - Investigate Failed Logins for Multiple Destinations - Response Task", "ESCU - Investigate Pass the Hash Attempts - Response Task", "ESCU - Investigate Previous Unseen User - Response Task"]
+detection_searches = ["ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Creation of lsass Dump with Taskmgr - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Extract SAM from Registry - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule"]
+mappings = {"cis20": ["CIS 16", "CIS 3", "CIS 5", "CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Exploitation", "Installation"], "mitre_attack": ["T1003.001", "T1003.002", "T1003.003", "T1059.001"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.IP"]}
+investigative_searches = ["ESCU - Investigate Failed Logins for Multiple Destinations - Response Task", "ESCU - Investigate Pass the Hash Attempts - Response Task", "ESCU - Investigate Pass the Ticket Attempts - Response Task", "ESCU - Investigate Previous Unseen User - Response Task"]
 support_searches = []
 data_models = ["Endpoint"]
 providing_technologies = none
@@ -435,7 +454,7 @@ version = 2
 reference = ["https://www.us-cert.gov/ncas/alerts/TA18-074A"]
 detection_searches = ["ESCU - Create local admin accounts using net exe - Rule", "ESCU - Detect New Local Admin account - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Single Letter Process On Endpoint - Rule", "ESCU - Suspicious Reg exe Process - Rule"]
 mappings = {"cis20": ["CIS 12", "CIS 16", "CIS 2", "CIS 3", "CIS 5", "CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Installation"], "mitre_attack": ["T1021.002", "T1053.005", "T1059.001", "T1059.003", "T1071.002", "T1112", "T1136.001", "T1204.002", "T1543.003", "T1547.001", "T1562.004"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.AC", "PR.AT", "PR.DS", "PR.IP", "PR.PT"]}
-investigative_searches = ["ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process File Activity - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task"]
+investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process File Activity - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"]
 support_searches = ["ESCU - Baseline of SMB Traffic - MLTK", "ESCU - Previously seen command line arguments"]
 data_models = ["Endpoint", "Network_Traffic"]
 providing_technologies = none
@@ -473,7 +492,7 @@ version = 1
 reference = ["https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html", "https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/", "http://www.noip.com/blog/2014/07/11/dynamic-dns-can-use-2/", "https://www.splunk.com/blog/2015/08/04/detecting-dynamic-dns-domains-in-splunk.html"]
 detection_searches = ["ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - DNS record changed - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule"]
 mappings = {"cis20": ["CIS 1", "CIS 12", "CIS 13", "CIS 3", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1048.003", "T1071.004", "T1189"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.DS", "PR.IP", "PR.PT"]}
-investigative_searches = ["ESCU - Get DNS Server History for a host - Response Task", "ESCU - DNS Hijack Enrichment - Response Task"]
+investigative_searches = ["ESCU - DNS Hijack Enrichment - Response Task", "ESCU - Get DNS Server History for a host - Response Task"]
 support_searches = ["ESCU - Discover DNS records"]
 data_models = ["Network_Resolution"]
 providing_technologies = none
@@ -489,6 +508,23 @@ In DNS hijacking, the attacker assumes control over an account or makes use of a
 The searches in this Analytic Story help you detect and investigate activities that may indicate that DNS hijacking has taken place within your environment.
 product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']

+[DarkSide Ransomware]
+category =  Malware
+creation_date = 2020-06-12
+modification_date = 2020-06-12
+id = 507edc74-13d5-4339-878e-b9114ded1f35
+version = 1
+reference = ["https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/", "https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html"]
+detection_searches = ["ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - BITSAdmin Download File - Rule", "ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule", "ESCU - CertUtil Download With URLCache and Split Arguments - Rule", "ESCU - CertUtil Download With VerifyCtl and Split Arguments - Rule", "ESCU - Cobalt Strike Named Pipes - Rule", "ESCU - Delete ShadowCopy With PowerShell - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect RClone Command-Line Usage - Rule", "ESCU - Detect Renamed RClone - Rule", "ESCU - Extract SAM from Registry - Rule", "ESCU - Ransomware Notes bulk creation - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule"]
+mappings = {"cis20": ["CIS 16", "CIS 3", "CIS 5", "CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Exfiltration", "Exploitation", "Obfuscation"], "mitre_attack": ["T1003.001", "T1003.002", "T1020", "T1021.002", "T1055", "T1105", "T1197", "T1218.003", "T1486", "T1490", "T1548.002"], "nist": ["DE.AE", "DE.CM", "PR.PT"]}
+investigative_searches = []
+support_searches = []
+data_models = ["Endpoint"]
+providing_technologies = none
+description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the DarkSide Ransomware
+narrative = This story addresses Darkside ransomware. This ransomware payload has many similarities to common ransomware however there are certain items particular to it. The creation of a .TXT log that shows every item being encrypted as well as the creation of ransomware notes and files adding a machine ID created based on CRC32 checksum algorithm. This ransomware payload leaves machines in minimal operation level,enough to browse the attackers websites. A customized URI with leaked information is presented to each victim.This is the ransomware payload that shut down the Colonial pipeline. The story is composed of several detection searches covering similar items to other ransomware payloads and those particular to Darkside payload.
+product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']
+
 [Data Exfiltration]
 category =  Adversary Tactics
 creation_date = 2020-10-21
@@ -515,7 +551,7 @@ version = 1
 reference = ["https://www.cisecurity.org/controls/data-protection/", "https://www.sans.org/reading-room/whitepapers/dns/splunk-detect-dns-tunneling-37022", "https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/"]
 detection_searches = ["ESCU - Detect USB device insertion - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule"]
 mappings = {"cis20": ["CIS 12", "CIS 13", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Installation"], "mitre_attack": ["T1048.003", "T1189"], "nist": ["DE.AE", "DE.CM", "PR.DS", "PR.PT"]}
-investigative_searches = ["ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get DNS Server History for a host - Response Task"]
+investigative_searches = ["ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"]
 support_searches = []
 data_models = ["Change_Analysis", "Network_Resolution"]
 providing_technologies = none
@@ -566,7 +602,7 @@ version = 2
 reference = ["https://attack.mitre.org/wiki/Technique/T1089", "https://blog.malwarebytes.com/cybercrime/2015/11/vonteera-adware-uses-certificates-to-disable-anti-malware/", "https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Tools-Report.pdf"]
 detection_searches = ["ESCU - Attempt To Add Certificate To Untrusted Store - Rule", "ESCU - Attempt To Stop Security Service - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Unload Sysmon Filter Driver - Rule"]
 mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Installation"], "mitre_attack": ["T1112", "T1543.003", "T1553.004", "T1562.001", "T1562.004"], "nist": ["DE.CM", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]}
-investigative_searches = ["ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"]
+investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
 support_searches = ["ESCU - Baseline of SMB Traffic - MLTK", "ESCU - Previously seen command line arguments"]
 data_models = ["Endpoint"]
 providing_technologies = none
@@ -600,7 +636,7 @@ version = 2
 reference = ["https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html", "https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/", "http://www.noip.com/blog/2014/07/11/dynamic-dns-can-use-2/", "https://www.splunk.com/blog/2015/08/04/detecting-dynamic-dns-domains-in-splunk.html"]
 detection_searches = ["ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detect web traffic to dynamic domain providers - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule"]
 mappings = {"cis20": ["CIS 12", "CIS 13", "CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Exploitation"], "mitre_attack": ["T1048", "T1071.001", "T1189"], "nist": ["DE.AE", "DE.CM", "DE.DP", "PR.DS", "PR.IP", "PR.PT"]}
-investigative_searches = ["ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task"]
+investigative_searches = ["ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"]
 support_searches = []
 data_models = ["Endpoint", "Network_Resolution", "Web"]
 providing_technologies = none
@@ -617,7 +653,7 @@ version = 1
 reference = ["https://www.us-cert.gov/ncas/alerts/TA18-201A", "https://www.first.org/resources/papers/conf2017/Advanced-Incident-Detection-and-Threat-Hunting-using-Sysmon-and-Splunk.pdf", "https://www.vkremez.com/2017/05/emotet-banking-trojan-malware-analysis.html"]
 detection_searches = ["ESCU - Detect Rare Executables - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - Detection of tools built by NirSoft - Rule", "ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule"]
 mappings = {"cis20": ["CIS 12", "CIS 2", "CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery", "Exploitation", "Installation"], "mitre_attack": ["T1021.002", "T1059.003", "T1072", "T1547.001", "T1566.001"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.DS", "PR.IP", "PR.PT"]}
-investigative_searches = ["ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task"]
+investigative_searches = ["ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"]
 support_searches = ["ESCU - Baseline of SMB Traffic - MLTK"]
 data_models = ["Email", "Endpoint", "Network_Traffic"]
 providing_technologies = none
@@ -691,8 +727,8 @@ version = 2
 reference = ["https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity", "https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf"]
 detection_searches = ["ESCU - Create or delete windows shares using net exe - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Suspicious File Write - Rule"]
 mappings = {"cis20": ["CIS 12", "CIS 16", "CIS 3", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1021.001", "T1021.002", "T1048.003", "T1059.001", "T1059.003", "T1070.005", "T1071.002", "T1071.004"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.IP", "PR.PT"]}
-investigative_searches = ["ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Outbound Emails to Hidden Cobra Threat Actors - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get DNS Server History for a host - Response Task"]
-support_searches = ["ESCU - Baseline of SMB Traffic - MLTK", "ESCU - Previously seen command line arguments", "ESCU - Baseline of DNS Query Length - MLTK"]
+investigative_searches = ["ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Outbound Emails to Hidden Cobra Threat Actors - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task"]
+support_searches = ["ESCU - Baseline of DNS Query Length - MLTK", "ESCU - Baseline of SMB Traffic - MLTK", "ESCU - Previously seen command line arguments"]
 data_models = ["Endpoint", "Network_Resolution", "Network_Traffic"]
 providing_technologies = none
 description = Monitor for and investigate activities, including the creation or deletion of hidden shares and file writes, that may be evidence of infiltration by North Korean government-sponsored cybercriminals. Details of this activity were reported in DHS Report TA-18-149A.
@@ -776,7 +812,7 @@ version = 1
 reference = ["https://github.com/splunk/cloud-datamodel-security-research"]
 detection_searches = ["ESCU - Amazon EKS Kubernetes Pod scan detection - Rule", "ESCU - Amazon EKS Kubernetes cluster scan detection - Rule", "ESCU - GCP Kubernetes cluster pod scan detection - Rule", "ESCU - GCP Kubernetes cluster scan detection - Rule", "ESCU - Kubernetes Azure pod scan fingerprint - Rule", "ESCU - Kubernetes Azure scan fingerprint - Rule"]
 mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1526"]}
-investigative_searches = ["ESCU - GCP Kubernetes activity by src ip - Response Task", "ESCU - Amazon EKS Kubernetes activity by src ip - Response Task", "ESCU - Get Notable History - Response Task"]
+investigative_searches = ["ESCU - Amazon EKS Kubernetes activity by src ip - Response Task", "ESCU - GCP Kubernetes activity by src ip - Response Task", "ESCU - Get Notable History - Response Task"]
 support_searches = []
 data_models = []
 providing_technologies = none
@@ -827,7 +863,7 @@ version = 2
 reference = ["https://www.fireeye.com/blog/executive-perspective/2015/08/malware_lateral_move.html"]
 detection_searches = ["ESCU - Detect Activity Related to Pass the Hash Attacks - Rule", "ESCU - Kerberoasting spn request with RC4 encryption - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - Schtasks scheduling job on remote system - Rule"]
 mappings = {"cis20": ["CIS 16", "CIS 3", "CIS 5", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1021.001", "T1053.005", "T1550.002", "T1558.003"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]}
-investigative_searches = ["ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task"]
+investigative_searches = ["ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task"]
 support_searches = []
 data_models = ["Endpoint", "Network_Traffic"]
 providing_technologies = none
@@ -848,7 +884,7 @@ version = 4
 reference = ["https://blogs.mcafee.com/mcafee-labs/malware-employs-powershell-to-infect-systems/", "https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"]
 detection_searches = ["ESCU - Any Powershell DownloadFile - Rule", "ESCU - Any Powershell DownloadString - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments - Rule", "ESCU - Malicious PowerShell Process With Obfuscation Techniques - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule"]
 mappings = {"cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Exploitation", "Installation"], "mitre_attack": ["T1027", "T1059.001"], "nist": ["DE.CM", "PR.IP", "PR.PT"]}
-investigative_searches = ["ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"]
+investigative_searches = ["ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
 support_searches = []
 data_models = ["Endpoint"]
 providing_technologies = none
@@ -910,7 +946,7 @@ version = 1
 reference = ["https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"]
 detection_searches = ["ESCU - Prohibited Software On Endpoint - Rule"]
 mappings = {"cis20": ["CIS 2"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Installation"], "nist": ["ID.AM", "PR.DS"]}
-investigative_searches = ["ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"]
+investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
 support_searches = []
 data_models = ["Endpoint"]
 providing_technologies = none
@@ -964,7 +1000,7 @@ version = 1
 reference = ["https://docs.microsoft.com/en-us/previous-versions/tn-archive/bb490939(v=technet.10)", "https://htmlpreview.github.io/?https://github.com/MatthewDemaske/blogbackup/blob/master/netshell.html", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html"]
 detection_searches = ["ESCU - Processes created by netsh - Rule", "ESCU - Processes launching netsh - Rule"]
 mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.004"], "nist": ["DE.CM", "PR.PT"]}
-investigative_searches = ["ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"]
+investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
 support_searches = ["ESCU - Baseline of SMB Traffic - MLTK", "ESCU - Previously seen command line arguments"]
 data_models = ["Endpoint"]
 providing_technologies = none
@@ -999,8 +1035,8 @@ version = 2
 reference = ["https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia", "https://www.infosecurity-magazine.com/news/healthcare-targeted-by-hacker/"]
 detection_searches = ["ESCU - First Time Seen Running Windows Service - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule"]
 mappings = {"cis20": ["CIS 2", "CIS 3", "CIS 5", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Installation"], "mitre_attack": ["T1059.001", "T1059.003", "T1543.003", "T1569.002"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.AC", "PR.AT", "PR.DS", "PR.IP", "PR.PT"]}
-investigative_searches = ["ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"]
-support_searches = ["ESCU - Previously Seen Running Windows Services - Initial", "ESCU - Previously seen command line arguments", "ESCU - Previously Seen Running Windows Services - Update"]
+investigative_searches = ["ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
+support_searches = ["ESCU - Previously Seen Running Windows Services - Initial", "ESCU - Previously Seen Running Windows Services - Update", "ESCU - Previously seen command line arguments"]
 data_models = ["Endpoint"]
 providing_technologies = none
 description = Detect activities and various techniques associated with the Orangeworm Attack Group, a group that frequently targets the healthcare industry.
@@ -1019,8 +1055,8 @@ version = 1
 reference = ["https://www.infosecurity-magazine.com/news/scope-of-mudcarp-attacks-highlight-1/", "http://blog.amossys.fr/badflick-is-not-so-bad.html"]
 detection_searches = ["ESCU - First time seen command line argument - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule"]
 mappings = {"cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1059.001", "T1059.003", "T1547.001"], "nist": ["DE.AE", "DE.CM", "PR.IP", "PR.PT"]}
-investigative_searches = ["ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"]
-support_searches = ["ESCU - Previously seen command line arguments", "ESCU - Baseline of Command Line Length - MLTK"]
+investigative_searches = ["ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
+support_searches = ["ESCU - Baseline of Command Line Length - MLTK", "ESCU - Previously seen command line arguments"]
 data_models = ["Endpoint"]
 providing_technologies = none
 description = Monitor your environment for suspicious behaviors that resemble the techniques employed by the MUDCARP threat group.
@@ -1063,7 +1099,7 @@ version = 1
 reference = ["http://www.novetta.com/2015/02/advanced-methods-to-detect-advanced-cyber-attacks-protocol-abuse/"]
 detection_searches = ["ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - TOR Traffic - Rule"]
 mappings = {"cis20": ["CIS 12", "CIS 13", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery"], "mitre_attack": ["T1048", "T1048.003", "T1071.001", "T1189"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.DS", "PR.PT"]}
-investigative_searches = ["ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get DNS Server History for a host - Response Task"]
+investigative_searches = ["ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"]
 support_searches = []
 data_models = ["Network_Resolution", "Network_Traffic"]
 providing_technologies = none
@@ -1078,10 +1114,10 @@ modification_date = 2020-02-04
 id = cf309d0d-d4aa-4fbb-963d-1e79febd3756
 version = 1
 reference = ["https://www.carbonblack.com/2017/06/28/carbon-black-threat-research-technical-analysis-petya-notpetya-ransomware/", "https://www.splunk.com/blog/2017/06/27/closing-the-detection-to-mitigation-gap-or-to-petya-or-notpetya-whocares-.html"]
-detection_searches = ["ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - TOR Traffic - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - Windows Event Log Cleared - Rule"]
-mappings = {"cis20": ["CIS 10", "CIS 12", "CIS 3", "CIS 5", "CIS 6", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery", "Exploitation", "Privilege Escalation"], "mitre_attack": ["T1021.002", "T1036.003", "T1047", "T1048", "T1053.005", "T1070", "T1070.001", "T1071.001", "T1485", "T1490", "T1547.001"], "nist": ["DE.AE", "DE.CM", "DE.DP", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]}
-investigative_searches = ["ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Backup Logs For Endpoint - Response Task"]
-support_searches = ["ESCU - Baseline of SMB Traffic - MLTK", "ESCU - Baseline of Command Line Length - MLTK"]
+detection_searches = ["ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect RClone Command-Line Usage - Rule", "ESCU - Detect Renamed RClone - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - TOR Traffic - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - Windows Event Log Cleared - Rule"]
+mappings = {"cis20": ["CIS 10", "CIS 12", "CIS 3", "CIS 5", "CIS 6", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery", "Exfiltration", "Exploitation", "Privilege Escalation"], "mitre_attack": ["T1020", "T1021.002", "T1036.003", "T1047", "T1048", "T1053.005", "T1070", "T1070.001", "T1071.001", "T1218.003", "T1485", "T1490", "T1547.001"], "nist": ["DE.AE", "DE.CM", "DE.DP", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]}
+investigative_searches = ["ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task"]
+support_searches = ["ESCU - Baseline of Command Line Length - MLTK", "ESCU - Baseline of SMB Traffic - MLTK"]
 data_models = ["Endpoint", "Network_Traffic"]
 providing_technologies = none
 description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware--spikes in SMB traffic, suspicious wevtutil usage, the presence of common ransomware extensions, and system processes run from unexpected locations, and many others.
@@ -1167,7 +1203,7 @@ version = 1
 reference = ["https://www.crowdstrike.com/blog/an-in-depth-analysis-of-samsam-ransomware-and-boss-spider/", "https://nakedsecurity.sophos.com/2018/07/31/samsam-the-almost-6-million-ransomware/", "https://thehackernews.com/2018/07/samsam-ransomware-attacks.html"]
 detection_searches = ["ESCU - Batch File Write to System32 - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule", "ESCU - Detect malicious requests to exploit JBoss servers - Rule", "ESCU - File with Samsam Extension - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Samsam Test File Write - Rule", "ESCU - Spike in File Writes - Rule"]
 mappings = {"cis20": ["CIS 10", "CIS 12", "CIS 16", "CIS 18", "CIS 2", "CIS 3", "CIS 4", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery", "Installation", "Reconnaissance"], "mitre_attack": ["T1021.001", "T1021.002", "T1082", "T1204.002", "T1485", "T1486", "T1490"], "nist": ["DE.AE", "DE.CM", "ID.AM", "ID.RA", "PR.AC", "PR.DS", "PR.IP", "PR.MA", "PR.PT"]}
-investigative_searches = ["ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Backup Logs For Endpoint - Response Task"]
+investigative_searches = ["ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task"]
 support_searches = []
 data_models = ["Endpoint", "Network_Traffic", "Web"]
 providing_technologies = none
@@ -1273,7 +1309,7 @@ version = 1
 reference = ["https://nvd.nist.gov/vuln/detail/CVE-2018-11409", "https://www.splunk.com/view/SP-CAAAP5E#VulnerabilityDescriptionsandRatings", "https://www.exploit-db.com/exploits/44865/"]
 detection_searches = ["ESCU - Splunk Enterprise Information Disclosure - Rule"]
 mappings = {"cis20": ["CIS 18", "CIS 3", "CIS 4"], "kill_chain_phases": ["Delivery"], "nist": ["DE.CM", "ID.RA", "PR.AC", "PR.IP", "PR.PT", "RS.MI"]}
-investigative_searches = ["ESCU - Investigate Network Traffic From src ip - Response Task", "ESCU - Get Notable History - Response Task"]
+investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Investigate Network Traffic From src ip - Response Task"]
 support_searches = []
 data_models = []
 providing_technologies = none
@@ -1293,7 +1329,7 @@ version = 1
 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
 detection_searches = ["ESCU - Abnormally High AWS Instances Launched by User - MLTK - Rule", "ESCU - Abnormally High AWS Instances Launched by User - Rule", "ESCU - Abnormally High AWS Instances Terminated by User - MLTK - Rule", "ESCU - Abnormally High AWS Instances Terminated by User - Rule", "ESCU - EC2 Instance Started In Previously Unseen Region - Rule", "ESCU - EC2 Instance Started With Previously Unseen User - Rule"]
 mappings = {"cis20": ["CIS 1", "CIS 12", "CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1535"], "nist": ["DE.AE", "DE.DP", "ID.AM"]}
-investigative_searches = ["ESCU - Get EC2 Launch Details - Response Task", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task"]
+investigative_searches = ["ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"]
 support_searches = ["ESCU - Baseline of Excessive AWS Instances Launched by User - MLTK", "ESCU - Baseline of Excessive AWS Instances Terminated by User - MLTK", "ESCU - Previously Seen AWS Regions", "ESCU - Previously Seen EC2 Launches By User"]
 data_models = []
 providing_technologies = none
@@ -1327,8 +1363,8 @@ version = 2
 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://www.tripwire.com/state-of-security/security-data-protection/cloud/public-aws-s3-buckets-writable/"]
 detection_searches = ["ESCU - Detect New Open S3 Buckets over AWS CLI - Rule", "ESCU - Detect New Open S3 buckets - Rule", "ESCU - Detect S3 access from a new IP - Rule", "ESCU - Detect Spike in S3 Bucket deletion - Rule"]
 mappings = {"cis20": ["CIS 13", "CIS 14"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["DE.CM", "DE.DP", "PR.AC", "PR.DS"]}
-investigative_searches = ["ESCU - AWS S3 Bucket details via bucketName - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"]
-support_searches = ["ESCU - Previously seen S3 bucket access by remote IP", "ESCU - Baseline of S3 Bucket deletion activity by ARN"]
+investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS S3 Bucket details via bucketName - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"]
+support_searches = ["ESCU - Baseline of S3 Bucket deletion activity by ARN", "ESCU - Previously seen S3 bucket access by remote IP"]
 data_models = []
 providing_technologies = none
 description = Use the searches in this Analytic Story to monitor your AWS S3 buckets for evidence of anomalous activity and suspicious behaviors, such as detecting open S3 buckets and buckets being accessed from a new IP. The contextual and investigative searches will give you more information, when required.
@@ -1346,7 +1382,7 @@ version = 1
 reference = ["https://rhinosecuritylabs.com/aws/hiding-cloudcobalt-strike-beacon-c2-using-amazon-apis/"]
 detection_searches = ["ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule"]
 mappings = {"cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "nist": ["DE.AE", "DE.CM", "PR.AC"]}
-investigative_searches = ["ESCU - Get DNS traffic ratio - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get DNS Server History for a host - Response Task"]
+investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"]
 support_searches = ["ESCU - Baseline of blocked outbound traffic from AWS"]
 data_models = []
 providing_technologies = none
@@ -1366,8 +1402,8 @@ version = 1
 reference = ["https://aws.amazon.com/blogs/security/aws-cloudtrail-now-tracks-cross-account-activity-to-its-origin/", "https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html"]
 detection_searches = ["ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule", "ESCU - Detect AWS Console Login by New User - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule"]
 mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.AE", "DE.DP", "PR.AC", "PR.DS"]}
-investigative_searches = ["ESCU - Investigate AWS User Activities by user field - Response Task", "ESCU - Get Notable History - Response Task"]
-support_searches = ["ESCU - Previously Seen AWS Cross Account Activity - Initial", "ESCU - Previously Seen Users in CloudTrail - Initial", "ESCU - Previously Seen AWS Cross Account Activity - Update", "ESCU - Previously Seen Users In CloudTrail - Update"]
+investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS User Activities by user field - Response Task"]
+support_searches = ["ESCU - Previously Seen AWS Cross Account Activity - Initial", "ESCU - Previously Seen AWS Cross Account Activity - Update", "ESCU - Previously Seen Users In CloudTrail - Update", "ESCU - Previously Seen Users in CloudTrail - Initial"]
 data_models = ["Authentication"]
 providing_technologies = none
 description = Monitor your cloud authentication events. Searches within this Analytic Story leverage the recent cloud updates to the Authentication data model to help you stay aware of and investigate suspicious login activity. 
@@ -1385,7 +1421,7 @@ reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.p
 detection_searches = ["ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule"]
 mappings = {"cis20": ["CIS 1", "CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.AE", "DE.DP", "ID.AM"]}
 investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"]
-support_searches = ["ESCU - Previously Seen Cloud Instance Modifications By User - Update", "ESCU - Baseline Of Cloud Instances Destroyed", "ESCU - Previously Seen Cloud Instance Modifications By User - Initial", "ESCU - Baseline Of Cloud Instances Launched"]
+support_searches = ["ESCU - Baseline Of Cloud Instances Destroyed", "ESCU - Baseline Of Cloud Instances Launched", "ESCU - Previously Seen Cloud Instance Modifications By User - Initial", "ESCU - Previously Seen Cloud Instance Modifications By User - Update"]
 data_models = ["Change"]
 providing_technologies = none
 description = Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment.
@@ -1402,7 +1438,7 @@ reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.p
 detection_searches = ["ESCU - Cloud Provisioning Activity From Previously Unseen City - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Country - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen IP Address - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Region - Rule"]
 mappings = {"cis20": ["CIS 1"], "mitre_attack": ["T1078"], "nist": ["ID.AM"]}
 investigative_searches = ["ESCU - Get Notable History - Response Task"]
-support_searches = ["ESCU - Previously Seen Cloud Provisioning Activity Sources - Update", "ESCU - Previously Seen Cloud Provisioning Activity Sources - Initial"]
+support_searches = ["ESCU - Previously Seen Cloud Provisioning Activity Sources - Initial", "ESCU - Previously Seen Cloud Provisioning Activity Sources - Update"]
 data_models = ["Change"]
 providing_technologies = none
 description = Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment.
@@ -1420,7 +1456,7 @@ reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.p
 detection_searches = ["ESCU - AWS IAM AccessDenied Discovery Events - Rule", "ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule", "ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule", "ESCU - Cloud API Calls From Previously Unseen User Roles - Rule"]
 mappings = {"cis20": ["CIS 1", "CIS 16"], "kill_chain_phases": ["Actions on Objectives", "Reconnaissance"], "mitre_attack": ["T1078", "T1078.004", "T1580"], "nist": ["DE.CM", "DE.DP", "ID.AM", "PR.AC"]}
 investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task"]
-support_searches = ["ESCU - Previously Seen Cloud API Calls Per User Role - Initial", "ESCU - Baseline Of Cloud Security Group API Calls Per User", "ESCU - Previously Seen Cloud API Calls Per User Role - Update", "ESCU - Baseline Of Cloud Infrastructure API Calls Per User"]
+support_searches = ["ESCU - Baseline Of Cloud Infrastructure API Calls Per User", "ESCU - Baseline Of Cloud Security Group API Calls Per User", "ESCU - Previously Seen Cloud API Calls Per User Role - Initial", "ESCU - Previously Seen Cloud API Calls Per User Role - Update"]
 data_models = ["Change"]
 providing_technologies = none
 description = Detect and investigate suspicious activities by users and roles in your cloud environments.
@@ -1437,8 +1473,8 @@ version = 2
 reference = ["https://attack.mitre.org/wiki/Technique/T1059", "https://www.microsoft.com/en-us/wdsi/threats/macro-malware", "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"]
 detection_searches = ["ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule"]
 mappings = {"cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Exploitation"], "mitre_attack": ["T1036.003", "T1059.001", "T1059.003"], "nist": ["DE.CM", "PR.IP", "PR.PT"]}
-investigative_searches = ["ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"]
-support_searches = ["ESCU - Previously seen command line arguments", "ESCU - Baseline of Command Line Length - MLTK"]
+investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
+support_searches = ["ESCU - Baseline of Command Line Length - MLTK", "ESCU - Previously seen command line arguments"]
 data_models = ["Endpoint"]
 providing_technologies = none
 description = Leveraging the Windows command-line interface (CLI) is one of the most common attack techniques--one that is also detailed in the MITRE ATT&CK framework. Use this Analytic Story to help you identify unusual or suspicious use of the CLI on Windows systems.
@@ -1454,7 +1490,7 @@ version = 1
 reference = ["http://blogs.splunk.com/2015/10/01/random-words-on-entropy-and-dns/", "http://www.darkreading.com/analytics/security-monitoring/got-malware-three-signs-revealed-in-dns-traffic/d/d-id/1139680", "https://live.paloaltonetworks.com/t5/Threat-Vulnerability-Articles/What-are-suspicious-DNS-queries/ta-p/71454"]
 detection_searches = ["ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule"]
 mappings = {"cis20": ["CIS 1", "CIS 12", "CIS 13", "CIS 3", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Exploitation"], "mitre_attack": ["T1048", "T1048.003", "T1071.004", "T1189"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.DS", "PR.IP", "PR.PT"]}
-investigative_searches = ["ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get DNS Server History for a host - Response Task"]
+investigative_searches = ["ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"]
 support_searches = ["ESCU - Baseline of DNS Query Length - MLTK"]
 data_models = ["Endpoint", "Network_Resolution"]
 providing_technologies = none
@@ -1471,7 +1507,7 @@ version = 1
 reference = ["https://www.splunk.com/blog/2015/06/26/phishing-hits-a-new-level-of-quality/"]
 detection_searches = ["ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Suspicious Email - UBA Anomaly - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule"]
 mappings = {"cis20": ["CIS 12", "CIS 3", "CIS 7"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1566", "T1566.001"], "nist": ["DE.AE", "PR.IP"]}
-investigative_searches = ["ESCU - Get Emails From Specific Sender - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Email Info - Response Task"]
+investigative_searches = ["ESCU - Get Email Info - Response Task", "ESCU - Get Emails From Specific Sender - Response Task", "ESCU - Get Notable History - Response Task"]
 support_searches = ["ESCU - DNSTwist Domain Names"]
 data_models = ["Email", "UEBA"]
 providing_technologies = none
@@ -1509,8 +1545,8 @@ version = 2
 reference = ["https://redcanary.com/blog/introducing-atomictestharnesses/", "https://redcanary.com/blog/windows-registry-attacks-threat-detection/", "https://attack.mitre.org/techniques/T1218/005/", "https://medium.com/@mbromileyDFIR/malware-monday-aebb456356c5"]
 detection_searches = ["ESCU - Detect MSHTA Url in Command Line - Rule", "ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Detect Rundll32 Inline HTA Execution - Rule", "ESCU - Detect mshta inline hta execution - Rule", "ESCU - Detect mshta renamed - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Suspicious mshta child process - Rule", "ESCU - Suspicious mshta spawn - Rule"]
 mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Exploitation"], "mitre_attack": ["T1059.003", "T1218.005", "T1547.001"], "nist": ["DE.AE", "DE.CM", "PR.PT"]}
-investigative_searches = ["ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"]
-support_searches = ["ESCU - Previously seen command line arguments", "ESCU - Baseline of Command Line Length - MLTK"]
+investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
+support_searches = ["ESCU - Baseline of Command Line Length - MLTK", "ESCU - Previously seen command line arguments"]
 data_models = ["Endpoint"]
 providing_technologies = none
 description = Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code.
@@ -1538,7 +1574,7 @@ version = 1
 reference = ["https://attack.mitre.org/wiki/Technique/T1078", "https://owasp.org/www-community/attacks/Credential_stuffing", "https://searchsecurity.techtarget.com/answer/What-is-a-password-spraying-attack-and-how-does-it-work"]
 detection_searches = ["ESCU - Multiple Okta Users With Invalid Credentials From The Same IP - Rule", "ESCU - Okta Account Lockout Events - Rule", "ESCU - Okta Failed SSO Attempts - Rule", "ESCU - Okta User Logins From Multiple Cities - Rule"]
 mappings = {"cis20": ["CIS 16"], "mitre_attack": ["T1078.001"], "nist": ["DE.CM"]}
-investigative_searches = ["ESCU - Investigate Okta Activity by app - Response Task", "ESCU - Investigate User Activities In Okta - Response Task", "ESCU - Investigate Okta Activity by IP Address - Response Task"]
+investigative_searches = ["ESCU - Investigate Okta Activity by IP Address - Response Task", "ESCU - Investigate Okta Activity by app - Response Task", "ESCU - Investigate User Activities In Okta - Response Task"]
 support_searches = []
 data_models = []
 providing_technologies = none
@@ -1591,7 +1627,7 @@ version = 2
 reference = ["https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf", "https://www.fireeye.com/blog/threat-research/2017/03/wmimplant_a_wmi_ba.html"]
 detection_searches = ["ESCU - Process Execution via WMI - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Remote WMI Command Attempt - Rule", "ESCU - Script Execution via WMI - Rule", "ESCU - WMI Permanent Event Subscription - Rule", "ESCU - WMI Permanent Event Subscription - Sysmon - Rule", "ESCU - WMI Temporary Event Subscription - Rule"]
 mappings = {"cis20": ["CIS 3", "CIS 5"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1047", "T1546.003"], "nist": ["PR.AC", "PR.AT", "PR.IP", "PR.PT"]}
-investigative_searches = ["ESCU - Get Sysmon WMI Activity for Host - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"]
+investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task"]
 support_searches = []
 data_models = ["Endpoint"]
 providing_technologies = none
@@ -1610,7 +1646,7 @@ version = 1
 reference = ["https://redcanary.com/blog/windows-registry-attacks-threat-detection/", "https://attack.mitre.org/wiki/Technique/T1112"]
 detection_searches = ["ESCU - Disabling Remote User Account Control - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Suspicious Changes to File Associations - Rule"]
 mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.001", "T1546.011", "T1546.012", "T1547.001", "T1547.010", "T1548.002", "T1564.001"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.IP", "PR.PT"]}
-investigative_searches = ["ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"]
+investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
 support_searches = []
 data_models = ["Endpoint"]
 providing_technologies = none
@@ -1638,6 +1674,23 @@ narrative = Zoom is a leader in modern enterprise video communications and its u
 Current detections focus on finding new child processes of this application on a per host basis. Investigative searches are included to gather information needed during an investigation.
 product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']

+[Trickbot]
+category =  Malware
+creation_date = 2021-04-20
+modification_date = 2021-04-20
+id = 16f93769-8342-44c0-9b1d-f131937cce8e
+version = 1
+reference = ["https://en.wikipedia.org/wiki/Trickbot", "https://blog.checkpoint.com/2021/03/11/february-2021s-most-wanted-malware-trickbot-takes-over-following-emotet-shutdown/"]
+detection_searches = ["ESCU - Account Discovery With Net App - Rule", "ESCU - Attempt To Stop Security Service - Rule", "ESCU - Cobalt Strike Named Pipes - Rule", "ESCU - Office Application Spawn rundll32 process - Rule", "ESCU - Office Document Executing Macro Code - Rule", "ESCU - Powershell Remote Thread To Known Windows Process - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Suspicious Rundll32 StartW - Rule", "ESCU - Trickbot Named Pipe - Rule", "ESCU - Wermgr Process Connecting To IP Check Web Services - Rule", "ESCU - Wermgr Process Create Executable File - Rule", "ESCU - Wermgr Process Spawned CMD Or Powershell Process - Rule", "ESCU - Write Executable in SMB Share - Rule"]
+mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Exploitation", "Installation", "Lateral Movement"], "mitre_attack": ["T1021.002", "T1027", "T1053", "T1055", "T1059", "T1087.002", "T1218.011", "T1562.001", "T1566.001", "T1590.005"], "nist": ["DE.CM", "PR.IP", "PR.PT"]}
+investigative_searches = []
+support_searches = []
+data_models = ["Endpoint"]
+providing_technologies = none
+description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the trickbot banking trojan, including looking for file writes associated with its payload, process injection, shellcode execution and data collection even in LDAP environment.
+narrative = trickbot banking trojan campaigns targeting banks and other vertical sectors.This malware is known in Microsoft Windows OS where target security Microsoft Defender to prevent its detection and removal. steal Verizon credentials and targeting banks using its multi component modules that collect and exfiltrate data.
+product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']
+
 [Trusted Developer Utilities Proxy Execution]
 category =  Adversary Tactics
 creation_date = 2021-01-12
@@ -1713,7 +1766,7 @@ version = 2
 reference = ["https://www.fireeye.com/blog/threat-research/2017/08/monitoring-windows-console-activity-part-two.html", "https://www.splunk.com/pdfs/technical-briefs/advanced-threat-detection-and-response-tech-brief.pdf", "https://www.sans.org/reading-room/whitepapers/logging/detecting-security-incidents-windows-workstation-event-logs-34262"]
 detection_searches = ["ESCU - Detect Rare Executables - Rule", "ESCU - Detect processes used for System Network Configuration Discovery - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule"]
 mappings = {"cis20": ["CIS 2", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Installation"], "mitre_attack": ["T1016", "T1036.003", "T1204.002", "T1218.011"], "nist": ["DE.CM", "ID.AM", "PR.DS", "PR.PT"]}
-investigative_searches = ["ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"]
+investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
 support_searches = ["ESCU - Baseline of Command Line Length - MLTK"]
 data_models = ["Endpoint"]
 providing_technologies = none
@@ -1732,7 +1785,7 @@ version = 1
 reference = ["https://www.monkey.org/~dugsong/dsniff/"]
 detection_searches = ["ESCU - Protocols passing authentication in cleartext - Rule"]
 mappings = {"cis20": ["CIS 14", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Reconnaissance"], "nist": ["DE.AE", "PR.AC", "PR.DS", "PR.PT"]}
-investigative_searches = ["ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Notable History - Response Task"]
+investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"]
 support_searches = []
 data_models = ["Network_Traffic"]
 providing_technologies = none
@@ -1749,7 +1802,7 @@ version = 1
 reference = ["https://www.fbi.gov/scams-and-safety/common-fraud-schemes/internet-fraud", "https://www.fbi.gov/news/stories/2017-internet-crime-report-released-050718"]
 detection_searches = ["ESCU - Web Fraud - Account Harvesting - Rule", "ESCU - Web Fraud - Anomalous User Clickspeed - Rule", "ESCU - Web Fraud - Password Sharing Across Accounts - Rule"]
 mappings = {"cis20": ["CIS 16", "CIS 6"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078", "T1136"], "nist": ["DE.AE", "DE.CM", "DE.DP"]}
-investigative_searches = ["ESCU - Get Web Session Information via session id - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Emails From Specific Sender - Response Task"]
+investigative_searches = ["ESCU - Get Emails From Specific Sender - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Web Session Information via session id - Response Task"]
 support_searches = []
 data_models = []
 providing_technologies = none
@@ -1786,9 +1839,9 @@ modification_date = 2018-05-31
 id = 56e24a28-5003-4047-b2db-e8f3c4618064
 version = 1
 reference = ["https://attack.mitre.org/wiki/Defense_Evasion"]
-detection_searches = ["ESCU - Disable Registry Tool - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Firewall with Netsh - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule"]
+detection_searches = ["ESCU - Disable Registry Tool - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Firewall with Netsh - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule"]
 mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Delivery", "Exploitation", "Privilege Escalation"], "mitre_attack": ["T1112", "T1222.001", "T1548.002", "T1562.001", "T1564.001"], "nist": ["DE.CM", "PR.PT"]}
-investigative_searches = ["ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"]
+investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
 support_searches = []
 data_models = ["Endpoint"]
 providing_technologies = none
@@ -1805,7 +1858,7 @@ version = 1
 reference = ["https://blog.malwarebytes.com/cybercrime/2013/12/file-extensions-2/", "https://attack.mitre.org/wiki/Technique/T1042"]
 detection_searches = ["ESCU - Execution of File With Spaces Before Extension - Rule", "ESCU - Execution of File with Multiple Extensions - Rule", "ESCU - Suspicious Changes to File Associations - Rule"]
 mappings = {"cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1036.003", "T1546.001"], "nist": ["DE.CM", "PR.IP", "PR.PT"]}
-investigative_searches = ["ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"]
+investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
 support_searches = []
 data_models = ["Endpoint"]
 providing_technologies = none
@@ -1826,7 +1879,7 @@ version = 2
 reference = ["https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/", "https://zeltser.com/security-incident-log-review-checklist/", "http://journeyintoir.blogspot.com/2013/01/re-introducing-usnjrnl.html"]
 detection_searches = ["ESCU - Deleting Shadow Copies - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Windows Event Log Cleared - Rule"]
 mappings = {"cis20": ["CIS 10", "CIS 3", "CIS 5", "CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070", "T1070.001", "T1490"], "nist": ["DE.AE", "DE.CM", "DE.DP", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]}
-investigative_searches = ["ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"]
+investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
 support_searches = []
 data_models = ["Endpoint"]
 providing_technologies = none
@@ -1842,9 +1895,9 @@ modification_date = 2018-05-31
 id = 30874d4f-20a1-488f-85ec-5d52ef74e3f9
 version = 2
 reference = ["http://www.fuzzysecurity.com/tutorials/19.html", "https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html", "http://resources.infosecinstitute.com/common-malware-persistence-mechanisms/", "https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html", "https://www.youtube.com/watch?v=dq2Hv7J9fvk"]
-detection_searches = ["ESCU - Certutil exe certificate extraction - Rule", "ESCU - Detect Path Interception By Creation Of program exe - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Shedule Task with HTTP Command Arguments - Rule", "ESCU - Shim Database File Creation - Rule", "ESCU - Shim Database Installation With Suspicious Parameters - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule"]
+detection_searches = ["ESCU - Certutil exe certificate extraction - Rule", "ESCU - Detect Path Interception By Creation Of program exe - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Schedule Task with HTTP Command Arguments - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Shim Database File Creation - Rule", "ESCU - Shim Database Installation With Suspicious Parameters - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule"]
 mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Exploitation", "Installation", "Privilege Escalation"], "mitre_attack": ["T1053", "T1053.005", "T1222.001", "T1543.003", "T1546.011", "T1547.001", "T1547.010", "T1564.001", "T1574.009", "T1574.011"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]}
-investigative_searches = ["ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"]
+investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
 support_searches = []
 data_models = ["Endpoint"]
 providing_technologies = none
@@ -1861,7 +1914,7 @@ version = 2
 reference = ["https://attack.mitre.org/tactics/TA0004/"]
 detection_searches = ["ESCU - Child Processes of Spoolsv exe - Rule", "ESCU - Overwriting Accessibility Binaries - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Uncommon Processes On Endpoint - Rule"]
 mappings = {"cis20": ["CIS 2", "CIS 5", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Exploitation"], "mitre_attack": ["T1068", "T1204.002", "T1546.008", "T1546.012"], "nist": ["DE.CM", "ID.AM", "PR.AC", "PR.DS", "PR.PT"]}
-investigative_searches = ["ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"]
+investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
 support_searches = []
 data_models = ["Endpoint"]
 providing_technologies = none
@@ -1878,7 +1931,7 @@ version = 3
 reference = ["https://attack.mitre.org/wiki/Technique/T1050", "https://attack.mitre.org/wiki/Technique/T1031"]
 detection_searches = ["ESCU - First Time Seen Running Windows Service - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule"]
 mappings = {"cis20": ["CIS 2", "CIS 3", "CIS 5", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Installation"], "mitre_attack": ["T1543.003", "T1569.002", "T1574.011"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.AC", "PR.AT", "PR.DS", "PR.IP", "PR.PT"]}
-investigative_searches = ["ESCU - Get Process Info - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Notable History - Response Task"]
+investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
 support_searches = ["ESCU - Previously Seen Running Windows Services - Initial", "ESCU - Previously Seen Running Windows Services - Update"]
 data_models = ["Endpoint"]
 providing_technologies = none
@@ -4,7 +4,7 @@
 is_configured = false
 state = enabled
 state_change_requires_restart = false
-build = 27601
+build = 28811

 [triggers]
 reload.analytic_stories = simple
@@ -19,7 +19,7 @@ reload.content-version = simple

 [launcher]
 author = Splunk
-version = 3.20.0
+version = 3.21.0
 description = Explore the Analytic Stories included with ES Content Updates.

 [ui]
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-04-29T21:10:45 UTC
+# On Date: 2021-05-13T21:46:44 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,2 +1,2 @@
 [content-version]
-version = 3.20.0
+version = 3.21.0
@@ -11,7 +11,7 @@ label = AWS Cryptomining
 description = Monitor your AWS EC2 instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or EC2 instances started by previously unseen users are just a few examples of potentially malicious behavior.
 disabled = 0

-panels = ["panel://workbench_panel_get_ec2_launch_details___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_investigate_aws_activities_via_region_name___response_task", "panel://workbench_panel_get_ec2_instance_details_by_instanceid___response_task"]
+panels = ["panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_ec2_instance_details_by_instanceid___response_task", "panel://workbench_panel_get_ec2_launch_details___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_investigate_aws_activities_via_region_name___response_task"]

 [panel_group://workbench_panel_group_aws_iam_privilege_escalation]
 label = AWS IAM Privilege Escalation
@@ -25,7 +25,7 @@ label = AWS Network ACL Activity
 description = Monitor your AWS network infrastructure for bad configurations and malicious activity. Investigative searches help you probe deeper, when the facts warrant it.
 disabled = 0

-panels = ["panel://workbench_panel_get_dns_traffic_ratio___response_task", "panel://workbench_panel_aws_network_interface_details_via_resourceid___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_all_aws_activity_from_ip_address___response_task", "panel://workbench_panel_aws_network_acl_details_from_id___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_dns_server_history_for_a_host___response_task"]
+panels = ["panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_aws_network_acl_details_from_id___response_task", "panel://workbench_panel_aws_network_interface_details_via_resourceid___response_task", "panel://workbench_panel_get_all_aws_activity_from_ip_address___response_task", "panel://workbench_panel_get_dns_server_history_for_a_host___response_task", "panel://workbench_panel_get_dns_traffic_ratio___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic___response_task"]

 [panel_group://workbench_panel_group_aws_security_hub_alerts]
 label = AWS Security Hub Alerts
@@ -39,21 +39,28 @@ label = AWS Suspicious Provisioning Activities
 description = Monitor your AWS provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your network.
 disabled = 0

-panels = ["panel://workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task", "panel://workbench_panel_get_all_aws_activity_from_region___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_all_aws_activity_from_country___response_task", "panel://workbench_panel_get_all_aws_activity_from_city___response_task", "panel://workbench_panel_get_all_aws_activity_from_ip_address___response_task"]
+panels = ["panel://workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_all_aws_activity_from_city___response_task", "panel://workbench_panel_get_all_aws_activity_from_country___response_task", "panel://workbench_panel_get_all_aws_activity_from_ip_address___response_task", "panel://workbench_panel_get_all_aws_activity_from_region___response_task"]

 [panel_group://workbench_panel_group_aws_user_monitoring]
 label = AWS User Monitoring
 description = Detect and investigate dormant user accounts for your AWS environment that have become active again. Because inactive and ad-hoc accounts are common attack targets, it's critical to enable governance within your environment.
 disabled = 0

-panels = ["panel://workbench_panel_investigate_aws_user_activities_by_user_field___response_task", "panel://workbench_panel_get_notable_history___response_task"]
+panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_investigate_aws_user_activities_by_user_field___response_task"]
+
+[panel_group://workbench_panel_group_active_directory_password_spraying]
+label = Active Directory Password Spraying
+description = Monitor for activities and techniques associated with Password Spraying attacks within Active Directory environments.
+disabled = 0
+
+panels = ["panel://workbench_panel_get_notable_history___response_task"]

 [panel_group://workbench_panel_group_apache_struts_vulnerability]
 label = Apache Struts Vulnerability
 description = Detect and investigate activities--such as unusually long `Content-Type` length, suspicious java classes and web servers executing suspicious processes--consistent with attempts to exploit Apache Struts vulnerabilities.
 disabled = 0

-panels = ["panel://workbench_panel_investigate_web_posts_from_src___response_task", "panel://workbench_panel_investigate_suspicious_strings_in_http_header___response_task", "panel://workbench_panel_get_notable_history___response_task"]
+panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_investigate_suspicious_strings_in_http_header___response_task", "panel://workbench_panel_investigate_web_posts_from_src___response_task"]

 [panel_group://workbench_panel_group_asset_tracking]
 label = Asset Tracking
@@ -81,7 +88,7 @@ label = Brand Monitoring
 description = Detect and investigate activity that may indicate that an adversary is using faux domains to mislead users into interacting with malicious infrastructure. Monitor DNS, email, and web traffic for permutations of your brand name.
 disabled = 0

-panels = ["panel://workbench_panel_get_emails_from_specific_sender___response_task", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_email_info___response_task"]
+panels = ["panel://workbench_panel_get_email_info___response_task", "panel://workbench_panel_get_emails_from_specific_sender___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic___response_task"]

 [panel_group://workbench_panel_group_clop_ransomware]
 label = Clop Ransomware
@@ -95,7 +102,7 @@ label = Cloud Cryptomining
 description = Monitor your cloud compute instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or compute instances started by previously unseen users are just a few examples of potentially malicious behavior.
 disabled = 0

-panels = ["panel://workbench_panel_get_ec2_launch_details___response_task", "panel://workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_investigate_aws_activities_via_region_name___response_task", "panel://workbench_panel_get_ec2_instance_details_by_instanceid___response_task"]
+panels = ["panel://workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_ec2_instance_details_by_instanceid___response_task", "panel://workbench_panel_get_ec2_launch_details___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_investigate_aws_activities_via_region_name___response_task"]

 [panel_group://workbench_panel_group_cloud_federated_credential_abuse]
 label = Cloud Federated Credential Abuse
@@ -116,21 +123,21 @@ label = ColdRoot MacOS RAT
 description = Leverage searches that allow you to detect and investigate unusual activities that relate to the ColdRoot Remote Access Trojan that affects MacOS. An example of some of these activities are changing sensative binaries in the MacOS sub-system, detecting process names and executables associated with the RAT, detecting when a keyboard tab is installed on a MacOS machine and more.
 disabled = 0

-panels = ["panel://workbench_panel_investigate_network_traffic_from_src_ip___response_task", "panel://workbench_panel_get_notable_history___response_task"]
+panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_investigate_network_traffic_from_src_ip___response_task"]

 [panel_group://workbench_panel_group_collection_and_staging]
 label = Collection and Staging
 description = Monitor for and investigate activities--such as suspicious writes to the Windows Recycling Bin or email servers sending high amounts of traffic to specific hosts, for example--that may indicate that an adversary is harvesting and exfiltrating sensitive data. 
 disabled = 0

-panels = ["panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task"]
+panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task"]

 [panel_group://workbench_panel_group_command_and_control]
 label = Command and Control
 description = Detect and investigate tactics, techniques, and procedures leveraged by attackers to establish and operate command and control channels. Implants installed by attackers on compromised endpoints use these channels to receive instructions and send data back to the malicious operators.
 disabled = 0

-panels = ["panel://workbench_panel_get_dns_traffic_ratio___response_task", "panel://workbench_panel_aws_network_interface_details_via_resourceid___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_all_aws_activity_from_ip_address___response_task", "panel://workbench_panel_aws_network_acl_details_from_id___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_dns_server_history_for_a_host___response_task"]
+panels = ["panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_aws_network_acl_details_from_id___response_task", "panel://workbench_panel_aws_network_interface_details_via_resourceid___response_task", "panel://workbench_panel_get_all_aws_activity_from_ip_address___response_task", "panel://workbench_panel_get_dns_server_history_for_a_host___response_task", "panel://workbench_panel_get_dns_traffic_ratio___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic___response_task"]

 [panel_group://workbench_panel_group_common_phishing_frameworks]
 label = Common Phishing Frameworks
@@ -151,14 +158,14 @@ label = Credential Dumping
 description = Uncover activity consistent with credential dumping, a technique wherein attackers compromise systems and attempt to obtain and exfiltrate passwords. The threat actors use these pilfered credentials to further escalate privileges and spread throughout a target environment. The included searches in this Analytic Story are designed to identify attempts to credential dumping.
 disabled = 0

-panels = ["panel://workbench_panel_investigate_pass_the_ticket_attempts___response_task", "panel://workbench_panel_investigate_failed_logins_for_multiple_destinations___response_task", "panel://workbench_panel_investigate_pass_the_hash_attempts___response_task", "panel://workbench_panel_investigate_previous_unseen_user___response_task"]
+panels = ["panel://workbench_panel_investigate_failed_logins_for_multiple_destinations___response_task", "panel://workbench_panel_investigate_pass_the_hash_attempts___response_task", "panel://workbench_panel_investigate_pass_the_ticket_attempts___response_task", "panel://workbench_panel_investigate_previous_unseen_user___response_task"]

 [panel_group://workbench_panel_group_dhs_report_ta18_074a]
 label = DHS Report TA18-074A
 description = Monitor for suspicious activities associated with DHS Technical Alert US-CERT TA18-074A. Some of the activities that adversaries used in these compromises included spearfishing attacks, malware, watering-hole domains, many and more.
 disabled = 0

-panels = ["panel://workbench_panel_get_process_information_for_port_activity___response_task", "panel://workbench_panel_get_process_file_activity___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task"]
+panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_file_activity___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task"]

 [panel_group://workbench_panel_group_dns_amplification_attacks]
 label = DNS Amplification Attacks
@@ -172,7 +179,14 @@ label = DNS Hijacking
 description = Secure your environment against DNS hijacks with searches that help you detect and investigate unauthorized changes to DNS records.
 disabled = 0

-panels = ["panel://workbench_panel_get_dns_server_history_for_a_host___response_task", "panel://workbench_panel_dns_hijack_enrichment___response_task"]
+panels = ["panel://workbench_panel_dns_hijack_enrichment___response_task", "panel://workbench_panel_get_dns_server_history_for_a_host___response_task"]
+
+[panel_group://workbench_panel_group_darkside_ransomware]
+label = DarkSide Ransomware
+description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the DarkSide Ransomware
+disabled = 0
+
+panels = ["panel://workbench_panel_get_notable_history___response_task"]

 [panel_group://workbench_panel_group_data_exfiltration]
 label = Data Exfiltration
@@ -186,7 +200,7 @@ label = Data Protection
 description = Fortify your data-protection arsenal--while continuing to ensure data confidentiality and integrity--with searches that monitor for and help you investigate possible signs of data exfiltration.
 disabled = 0

-panels = ["panel://workbench_panel_get_dns_traffic_ratio___response_task", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_dns_server_history_for_a_host___response_task"]
+panels = ["panel://workbench_panel_get_dns_server_history_for_a_host___response_task", "panel://workbench_panel_get_dns_traffic_ratio___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic___response_task"]

 [panel_group://workbench_panel_group_deobfuscate_decode_files_or_information]
 label = Deobfuscate-Decode Files or Information
@@ -207,7 +221,7 @@ label = Disabling Security Tools
 description = Looks for activities and techniques associated with the disabling of security tools on a Windows system, such as suspicious `reg.exe` processes, processes launching netsh, and many others.
 disabled = 0

-panels = ["panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task"]
+panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task"]

 [panel_group://workbench_panel_group_domain_trust_discovery]
 label = Domain Trust Discovery
@@ -221,14 +235,14 @@ label = Dynamic DNS
 description = Detect and investigate hosts in your environment that may be communicating with dynamic domain providers. Attackers may leverage these services to help them avoid firewall blocks and deny lists.
 disabled = 0

-panels = ["panel://workbench_panel_get_dns_traffic_ratio___response_task", "panel://workbench_panel_get_dns_server_history_for_a_host___response_task", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic___response_task", "panel://workbench_panel_get_notable_history___response_task"]
+panels = ["panel://workbench_panel_get_dns_server_history_for_a_host___response_task", "panel://workbench_panel_get_dns_traffic_ratio___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic___response_task"]

 [panel_group://workbench_panel_group_emotet_malware__dhs_report_ta18_201a_]
 label = Emotet Malware  DHS Report TA18-201A 
 description = Detect rarely used executables, specific registry paths that may confer malware survivability and persistence, instances where cmd.exe is used to launch script interpreters, and other indicators that the Emotet financial malware has compromised your environment.
 disabled = 0

-panels = ["panel://workbench_panel_get_history_of_email_sources___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task"]
+panels = ["panel://workbench_panel_get_history_of_email_sources___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task"]

 [panel_group://workbench_panel_group_f5_tmui_rce_cve_2020_5902]
 label = F5 TMUI RCE CVE-2020-5902
@@ -256,7 +270,7 @@ label = Hidden Cobra Malware
 description = Monitor for and investigate activities, including the creation or deletion of hidden shares and file writes, that may be evidence of infiltration by North Korean government-sponsored cybercriminals. Details of this activity were reported in DHS Report TA-18-149A.
 disabled = 0

-panels = ["panel://workbench_panel_get_dns_traffic_ratio___response_task", "panel://workbench_panel_get_history_of_email_sources___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task", "panel://workbench_panel_get_outbound_emails_to_hidden_cobra_threat_actors___response_task", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_investigate_successful_remote_desktop_authentications___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_dns_server_history_for_a_host___response_task"]
+panels = ["panel://workbench_panel_get_dns_server_history_for_a_host___response_task", "panel://workbench_panel_get_dns_traffic_ratio___response_task", "panel://workbench_panel_get_history_of_email_sources___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_outbound_emails_to_hidden_cobra_threat_actors___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic___response_task", "panel://workbench_panel_investigate_successful_remote_desktop_authentications___response_task"]

 [panel_group://workbench_panel_group_host_redirection]
 label = Host Redirection
@@ -284,7 +298,7 @@ label = Kubernetes Scanning Activity
 description = This story addresses detection against Kubernetes cluster fingerprint scan and attack by providing information on items such as source ip, user agent, cluster names.
 disabled = 0

-panels = ["panel://workbench_panel_gcp_kubernetes_activity_by_src_ip___response_task", "panel://workbench_panel_amazon_eks_kubernetes_activity_by_src_ip___response_task", "panel://workbench_panel_get_notable_history___response_task"]
+panels = ["panel://workbench_panel_amazon_eks_kubernetes_activity_by_src_ip___response_task", "panel://workbench_panel_gcp_kubernetes_activity_by_src_ip___response_task", "panel://workbench_panel_get_notable_history___response_task"]

 [panel_group://workbench_panel_group_kubernetes_sensitive_object_access_activity]
 label = Kubernetes Sensitive Object Access Activity
@@ -305,14 +319,14 @@ label = Lateral Movement
 description = Detect and investigate tactics, techniques, and procedures around how attackers move laterally within the enterprise. Because lateral movement can expose the adversary to detection, it should be an important focus for security analysts.
 disabled = 0

-panels = ["panel://workbench_panel_get_history_of_email_sources___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_investigate_successful_remote_desktop_authentications___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task"]
+panels = ["panel://workbench_panel_get_history_of_email_sources___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task", "panel://workbench_panel_investigate_successful_remote_desktop_authentications___response_task"]

 [panel_group://workbench_panel_group_malicious_powershell]
 label = Malicious PowerShell
 description = Attackers are finding stealthy ways "live off the land," leveraging utilities and tools that come standard on the endpoint--such as PowerShell--to achieve their goals without downloading binary files. These searches can help you detect and investigate PowerShell command-line options that may be indicative of malicious intent.
 disabled = 0

-panels = ["panel://workbench_panel_get_history_of_email_sources___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task"]
+panels = ["panel://workbench_panel_get_history_of_email_sources___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task"]

 [panel_group://workbench_panel_group_masquerading___rename_system_utilities]
 label = Masquerading - Rename System Utilities
@@ -333,7 +347,7 @@ label = Monitor for Unauthorized Software
 description = Identify and investigate prohibited/unauthorized software or processes that may be concealing malicious behavior within your environment. 
 disabled = 0

-panels = ["panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task"]
+panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task"]

 [panel_group://workbench_panel_group_monitor_for_updates]
 label = Monitor for Updates
@@ -354,7 +368,7 @@ label = Netsh Abuse
 description = Detect activities and various techniques associated with the abuse of `netsh.exe`, which can disable local firewall settings or set up a remote connection to a host from an infected system.
 disabled = 0

-panels = ["panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task"]
+panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task"]

 [panel_group://workbench_panel_group_office_365_detections]
 label = Office 365 Detections
@@ -368,28 +382,28 @@ label = Orangeworm Attack Group
 description = Detect activities and various techniques associated with the Orangeworm Attack Group, a group that frequently targets the healthcare industry.
 disabled = 0

-panels = ["panel://workbench_panel_get_history_of_email_sources___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task"]
+panels = ["panel://workbench_panel_get_history_of_email_sources___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task"]

 [panel_group://workbench_panel_group_possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns]
 label = Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns
 description = Monitor your environment for suspicious behaviors that resemble the techniques employed by the MUDCARP threat group.
 disabled = 0

-panels = ["panel://workbench_panel_get_history_of_email_sources___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task"]
+panels = ["panel://workbench_panel_get_history_of_email_sources___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task"]

 [panel_group://workbench_panel_group_prohibited_traffic_allowed_or_protocol_mismatch]
 label = Prohibited Traffic Allowed or Protocol Mismatch
 description = Detect instances of prohibited network traffic allowed in the environment, as well as protocols running on non-standard ports. Both of these types of behaviors typically violate policy and can be leveraged by attackers.
 disabled = 0

-panels = ["panel://workbench_panel_get_process_information_for_port_activity___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_dns_server_history_for_a_host___response_task"]
+panels = ["panel://workbench_panel_get_dns_server_history_for_a_host___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task"]

 [panel_group://workbench_panel_group_ransomware]
 label = Ransomware
 description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware--spikes in SMB traffic, suspicious wevtutil usage, the presence of common ransomware extensions, and system processes run from unexpected locations, and many others.
 disabled = 0

-panels = ["panel://workbench_panel_get_history_of_email_sources___response_task", "panel://workbench_panel_get_sysmon_wmi_activity_for_host___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_backup_logs_for_endpoint___response_task"]
+panels = ["panel://workbench_panel_get_backup_logs_for_endpoint___response_task", "panel://workbench_panel_get_history_of_email_sources___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task", "panel://workbench_panel_get_sysmon_wmi_activity_for_host___response_task"]

 [panel_group://workbench_panel_group_ransomware_cloud]
 label = Ransomware Cloud
@@ -424,7 +438,7 @@ label = SamSam Ransomware
 description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the SamSam ransomware, including looking for file writes associated with SamSam, RDP brute force attacks, the presence of files with SamSam ransomware extensions, suspicious psexec use, and more.
 disabled = 0

-panels = ["panel://workbench_panel_get_history_of_email_sources___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_investigate_successful_remote_desktop_authentications___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_backup_logs_for_endpoint___response_task"]
+panels = ["panel://workbench_panel_get_backup_logs_for_endpoint___response_task", "panel://workbench_panel_get_history_of_email_sources___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task", "panel://workbench_panel_investigate_successful_remote_desktop_authentications___response_task"]

 [panel_group://workbench_panel_group_silver_sparrow]
 label = Silver Sparrow
@@ -459,14 +473,14 @@ label = Splunk Enterprise Vulnerability CVE-2018-11409
 description = Reduce the risk of CVE-2018-11409, an information disclosure vulnerability within some older versions of Splunk Enterprise, with searches designed to help ensure that your Splunk system does not leak information to authenticated users.
 disabled = 0

-panels = ["panel://workbench_panel_investigate_network_traffic_from_src_ip___response_task", "panel://workbench_panel_get_notable_history___response_task"]
+panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_investigate_network_traffic_from_src_ip___response_task"]

 [panel_group://workbench_panel_group_suspicious_aws_ec2_activities]
 label = Suspicious AWS EC2 Activities
 description = Use the searches in this Analytic Story to monitor your AWS EC2 instances for evidence of anomalous activity and suspicious behaviors, such as EC2 instances that originate from unusual locations or those launched by previously unseen users (among others). Included investigative searches will help you probe more deeply, when the information warrants it.
 disabled = 0

-panels = ["panel://workbench_panel_get_ec2_launch_details___response_task", "panel://workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_investigate_aws_activities_via_region_name___response_task", "panel://workbench_panel_get_ec2_instance_details_by_instanceid___response_task"]
+panels = ["panel://workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_ec2_instance_details_by_instanceid___response_task", "panel://workbench_panel_get_ec2_launch_details___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_investigate_aws_activities_via_region_name___response_task"]

 [panel_group://workbench_panel_group_suspicious_aws_login_activities]
 label = Suspicious AWS Login Activities
@@ -480,21 +494,21 @@ label = Suspicious AWS S3 Activities
 description = Use the searches in this Analytic Story to monitor your AWS S3 buckets for evidence of anomalous activity and suspicious behaviors, such as detecting open S3 buckets and buckets being accessed from a new IP. The contextual and investigative searches will give you more information, when required.
 disabled = 0

-panels = ["panel://workbench_panel_aws_s3_bucket_details_via_bucketname___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_all_aws_activity_from_ip_address___response_task", "panel://workbench_panel_investigate_aws_activities_via_region_name___response_task"]
+panels = ["panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_aws_s3_bucket_details_via_bucketname___response_task", "panel://workbench_panel_get_all_aws_activity_from_ip_address___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_investigate_aws_activities_via_region_name___response_task"]

 [panel_group://workbench_panel_group_suspicious_aws_traffic]
 label = Suspicious AWS Traffic
 description = Leverage these searches to monitor your AWS network traffic for evidence of anomalous activity and suspicious behaviors, such as a spike in blocked outbound traffic in your virtual private cloud (VPC).
 disabled = 0

-panels = ["panel://workbench_panel_get_dns_traffic_ratio___response_task", "panel://workbench_panel_aws_network_interface_details_via_resourceid___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_all_aws_activity_from_ip_address___response_task", "panel://workbench_panel_aws_network_acl_details_from_id___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_dns_server_history_for_a_host___response_task"]
+panels = ["panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_aws_network_acl_details_from_id___response_task", "panel://workbench_panel_aws_network_interface_details_via_resourceid___response_task", "panel://workbench_panel_get_all_aws_activity_from_ip_address___response_task", "panel://workbench_panel_get_dns_server_history_for_a_host___response_task", "panel://workbench_panel_get_dns_traffic_ratio___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic___response_task"]

 [panel_group://workbench_panel_group_suspicious_cloud_authentication_activities]
 label = Suspicious Cloud Authentication Activities
 description = Monitor your cloud authentication events. Searches within this Analytic Story leverage the recent cloud updates to the Authentication data model to help you stay aware of and investigate suspicious login activity. 
 disabled = 0

-panels = ["panel://workbench_panel_investigate_aws_user_activities_by_user_field___response_task", "panel://workbench_panel_get_notable_history___response_task"]
+panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_investigate_aws_user_activities_by_user_field___response_task"]

 [panel_group://workbench_panel_group_suspicious_cloud_instance_activities]
 label = Suspicious Cloud Instance Activities
@@ -522,21 +536,21 @@ label = Suspicious Command-Line Executions
 description = Leveraging the Windows command-line interface (CLI) is one of the most common attack techniques--one that is also detailed in the MITRE ATT&CK framework. Use this Analytic Story to help you identify unusual or suspicious use of the CLI on Windows systems.
 disabled = 0

-panels = ["panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task"]
+panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task"]

 [panel_group://workbench_panel_group_suspicious_dns_traffic]
 label = Suspicious DNS Traffic
 description = Attackers often attempt to hide within or otherwise abuse the domain name system (DNS). You can thwart attempts to manipulate this omnipresent protocol by monitoring for these types of abuses.
 disabled = 0

-panels = ["panel://workbench_panel_get_dns_traffic_ratio___response_task", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_dns_server_history_for_a_host___response_task"]
+panels = ["panel://workbench_panel_get_dns_server_history_for_a_host___response_task", "panel://workbench_panel_get_dns_traffic_ratio___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic___response_task"]

 [panel_group://workbench_panel_group_suspicious_emails]
 label = Suspicious Emails
 description = Email remains one of the primary means for attackers to gain an initial foothold within the modern enterprise. Detect and investigate suspicious emails in your environment with the help of the searches in this Analytic Story.
 disabled = 0

-panels = ["panel://workbench_panel_get_emails_from_specific_sender___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_email_info___response_task"]
+panels = ["panel://workbench_panel_get_email_info___response_task", "panel://workbench_panel_get_emails_from_specific_sender___response_task", "panel://workbench_panel_get_notable_history___response_task"]

 [panel_group://workbench_panel_group_suspicious_gcp_storage_activities]
 label = Suspicious GCP Storage Activities
@@ -550,14 +564,14 @@ label = Suspicious MSHTA Activity
 description = Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code.
 disabled = 0

-panels = ["panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task"]
+panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task"]

 [panel_group://workbench_panel_group_suspicious_okta_activity]
 label = Suspicious Okta Activity
 description = Monitor your Okta environment for suspicious activities. Due to the Covid outbreak, many users are migrating over to leverage cloud services more and more. Okta is a popular tool to manage multiple users and the web-based applications they need to stay productive. The searches in this story will help monitor your Okta environment for suspicious activities and associated user behaviors.
 disabled = 0

-panels = ["panel://workbench_panel_investigate_okta_activity_by_app___response_task", "panel://workbench_panel_investigate_user_activities_in_okta___response_task", "panel://workbench_panel_investigate_okta_activity_by_ip_address___response_task"]
+panels = ["panel://workbench_panel_investigate_okta_activity_by_ip_address___response_task", "panel://workbench_panel_investigate_okta_activity_by_app___response_task", "panel://workbench_panel_investigate_user_activities_in_okta___response_task"]

 [panel_group://workbench_panel_group_suspicious_regsvr32_activity]
 label = Suspicious Regsvr32 Activity
@@ -578,14 +592,14 @@ label = Suspicious WMI Use
 description = Attackers are increasingly abusing Windows Management Instrumentation (WMI), a framework and associated utilities available on all modern Windows operating systems. Because WMI can be leveraged to manage both local and remote systems, it is important to identify the processes executed and the user context within which the activity occurred.
 disabled = 0

-panels = ["panel://workbench_panel_get_sysmon_wmi_activity_for_host___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task"]
+panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_sysmon_wmi_activity_for_host___response_task"]

 [panel_group://workbench_panel_group_suspicious_windows_registry_activities]
 label = Suspicious Windows Registry Activities
 description = Monitor and detect registry changes initiated from remote locations, which can be a sign that an attacker has infiltrated your system.
 disabled = 0

-panels = ["panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task"]
+panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task"]

 [panel_group://workbench_panel_group_suspicious_zoom_child_processes]
 label = Suspicious Zoom Child Processes
@@ -594,6 +608,13 @@ disabled = 0

 panels = ["panel://workbench_panel_get_process_file_activity___response_task"]

+[panel_group://workbench_panel_group_trickbot]
+label = Trickbot
+description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the trickbot banking trojan, including looking for file writes associated with its payload, process injection, shellcode execution and data collection even in LDAP environment.
+disabled = 0
+
+panels = ["panel://workbench_panel_get_notable_history___response_task"]
+
 [panel_group://workbench_panel_group_trusted_developer_utilities_proxy_execution]
 label = Trusted Developer Utilities Proxy Execution
 description = Monitor and detect behaviors used by attackers who leverage trusted developer utilities to execute malicious code.
@@ -620,21 +641,21 @@ label = Unusual Processes
 description = Quickly identify systems running new or unusual processes in your environment that could be indicators of suspicious activity. Processes run from unusual locations, those with conspicuously long command lines, and rare executables are all examples of activities that may warrant deeper investigation.
 disabled = 0

-panels = ["panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task"]
+panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task"]

 [panel_group://workbench_panel_group_use_of_cleartext_protocols]
 label = Use of Cleartext Protocols
 description = Leverage searches that detect cleartext network protocols that may leak credentials or should otherwise be encrypted.
 disabled = 0

-panels = ["panel://workbench_panel_get_process_information_for_port_activity___response_task", "panel://workbench_panel_get_notable_history___response_task"]
+panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task"]

 [panel_group://workbench_panel_group_web_fraud_detection]
 label = Web Fraud Detection
 description = Monitor your environment for activity consistent with common attack techniques bad actors use when attempting to compromise web servers or other web-related assets.
 disabled = 0

-panels = ["panel://workbench_panel_get_web_session_information_via_session_id___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_emails_from_specific_sender___response_task"]
+panels = ["panel://workbench_panel_get_emails_from_specific_sender___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_web_session_information_via_session_id___response_task"]

 [panel_group://workbench_panel_group_windows_dns_sigred_cve_2020_1350]
 label = Windows DNS SIGRed CVE-2020-1350
@@ -648,42 +669,42 @@ label = Windows Defense Evasion Tactics
 description = Detect tactics used by malware to evade defenses on Windows endpoints. A few of these include suspicious `reg.exe` processes, files hidden with `attrib.exe` and disabling user-account control, among many others 
 disabled = 0

-panels = ["panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task"]
+panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task"]

 [panel_group://workbench_panel_group_windows_file_extension_and_association_abuse]
 label = Windows File Extension and Association Abuse
 description = Detect and investigate suspected abuse of file extensions and Windows file associations. Some of the malicious behaviors involved may include inserting spaces before file extensions or prepending the file extension with a different one, among other techniques.
 disabled = 0

-panels = ["panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task"]
+panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task"]

 [panel_group://workbench_panel_group_windows_log_manipulation]
 label = Windows Log Manipulation
 description = Adversaries often try to cover their tracks by manipulating Windows logs. Use these searches to help you monitor for suspicious activity surrounding log files--an essential component of an effective defense.
 disabled = 0

-panels = ["panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task"]
+panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task"]

 [panel_group://workbench_panel_group_windows_persistence_techniques]
 label = Windows Persistence Techniques
 description = Monitor for activities and techniques associated with maintaining persistence on a Windows system--a sign that an adversary may have compromised your environment.
 disabled = 0

-panels = ["panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task"]
+panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task"]

 [panel_group://workbench_panel_group_windows_privilege_escalation]
 label = Windows Privilege Escalation
 description = Monitor for and investigate activities that may be associated with a Windows privilege-escalation attack, including unusual processes running on endpoints, modified registry keys, and more.
 disabled = 0

-panels = ["panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task"]
+panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task"]

 [panel_group://workbench_panel_group_windows_service_abuse]
 label = Windows Service Abuse
 description = Windows services are often used by attackers for persistence and the ability to load drivers or otherwise interact with the Windows kernel. This Analytic Story helps you monitor your environment for indications that Windows services are being modified or created in a suspicious manner.
 disabled = 0

-panels = ["panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_notable_history___response_task"]
+panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task"]



@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-04-29T21:10:45 UTC
+# On Date: 2021-05-13T21:46:44 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -142,6 +142,10 @@ description = customer specific splunk configurations(eg- index, source, sourcet
 definition = eventtype="osquery-process"
 description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

+[powershell]
+definition = sourcetype=wineventlog OR source=WinEventLog:Microsoft-Windows-PowerShell/Operational
+description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
+
 [previously_seen_cloud_api_calls_per_user_role_forget_window]
 definition = "-90d@d"
 description = Use this macro to determine how long to keep track of cloud api calls per user role
@@ -419,6 +423,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 

+[account_discovery_with_net_app_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [amazon_eks_kubernetes_pod_scan_detection_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
@@ -467,6 +475,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 

+[cmlua_or_cmstplua_uac_bypass_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [certutil_download_with_urlcache_and_split_arguments_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
@@ -619,6 +631,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 

+[delete_shadowcopy_with_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [deleting_shadow_copies_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
@@ -783,6 +799,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 

+[detect_rclone_command_line_usage_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [detect_rare_executables_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
@@ -815,6 +835,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 

+[detect_renamed_rclone_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [detect_rogue_dhcp_server_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
@@ -1071,6 +1095,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 

+[extract_sam_from_registry_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [file_with_samsam_extension_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
@@ -1275,10 +1303,42 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 

+[multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [multiple_okta_users_with_invalid_credentials_from_the_same_ip_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 

+[multiple_users_attempting_to_authenticate_using_explicit_credentials_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[multiple_users_failing_to_authenticate_from_host_using_kerberos_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[multiple_users_failing_to_authenticate_from_host_using_ntlm_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[multiple_users_failing_to_authenticate_from_process_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[multiple_users_remotely_failing_to_authenticate_from_host_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [nltest_domain_trust_discovery_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
@@ -1411,6 +1471,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 

+[powershell_remote_thread_to_known_windows_process_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [process_creating_lnk_file_in_suspicious_location_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
@@ -1519,6 +1583,14 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 

+[slui_runas_elevated_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[slui_spawning_a_process_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [smb_traffic_spike_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
@@ -1539,6 +1611,14 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 

+[schedule_task_with_http_command_arguments_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[schedule_task_with_rundll32_command_trigger_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [scheduled_task_deleted_or_created_via_cmd_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
@@ -1567,10 +1647,6 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 

-[shedule_task_with_http_command_arguments_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
 [shim_database_file_creation_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
@@ -1735,6 +1811,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 

+[trickbot_named_pipe_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [usn_journal_deletion_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
@@ -1807,6 +1887,18 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 

+[wermgr_process_connecting_to_ip_check_web_services_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[wermgr_process_create_executable_file_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[wermgr_process_spawned_cmd_or_powershell_process_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [winevent_scheduled_task_created_within_public_path_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
@@ -1851,6 +1943,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 

+[write_executable_in_smb_share_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [aws_detect_attach_to_role_policy_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-04-29T21:10:45 UTC
+# On Date: 2021-05-13T21:46:44 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,182 +1,59 @@
 mitre_id,technique,tactics,groups
-T1553.006,Code Signing Policy Modification,Defense Evasion,Turla|APT39
-T1614,System Location Discovery,Discovery,no
-T1613,Container and Resource Discovery,Discovery,no
-T1552.007,Container API,Credential Access,no
-T1612,Build Image on Host,Defense Evasion,no
-T1611,Escape to Host,Privilege Escalation,no
-T1204.003,Malicious Image,Execution,no
-T1053.007,Container Orchestration Job,Execution|Persistence|Privilege Escalation,no
-T1610,Deploy Container,Defense Evasion|Execution,no
-T1609,Container Administration Command,Execution,no
-T1608.005,Link Target,Resource Development,Silent Librarian
-T1608.004,Drive-by Target,Resource Development,APT32|Threat Group-3390
-T1608.003,Install Digital Certificate,Resource Development,no
-T1608.002,Upload Tool,Resource Development,Threat Group-3390
-T1608.001,Upload Malware,Resource Development,APT32
-T1608,Stage Capabilities,Resource Development,no
-T1016.001,Internet Connection Discovery,Discovery,APT29|UNC2452|Turla
-T1553.005,Mark-of-the-Web Bypass,Defense Evasion,TA505
-T1555.005,Password Managers,Credential Access,Fox Kitten|Operation Wocao
-T1484.002,Domain Trust Modification,Defense Evasion|Privilege Escalation,APT29|UNC2452
-T1484.001,Group Policy Modification,Defense Evasion|Privilege Escalation,Indrik Spider
-T1547.014,Active Setup,Persistence|Privilege Escalation,no
-T1606.002,SAML Tokens,Credential Access,APT29|UNC2452
-T1606.001,Web Cookies,Credential Access,APT29|UNC2452
-T1606,Forge Web Credentials,Credential Access,no
-T1555.004,Windows Credential Manager,Credential Access,Stealth Falcon|OilRig|Turla
-T1059.008,Network Device CLI,Execution,no
-T1602.002,Network Device Configuration Dump,Collection,no
-T1542.005,TFTP Boot,Defense Evasion|Persistence,no
-T1542.004,ROMMONkit,Defense Evasion|Persistence,no
-T1602.001,SNMP (MIB Dump),Collection,no
-T1602,Data from Configuration Repository,Collection,no
-T1601.002,Downgrade System Image,Defense Evasion,no
-T1601.001,Patch System Image,Defense Evasion,no
-T1601,Modify System Image,Defense Evasion,no
-T1600.002,Disable Crypto Hardware,Defense Evasion,no
-T1600.001,Reduce Key Space,Defense Evasion,no
-T1600,Weaken Encryption,Defense Evasion,no
-T1556.004,Network Device Authentication,Credential Access|Defense Evasion|Persistence,no
-T1599.001,Network Address Translation Traversal,Defense Evasion,no
-T1599,Network Boundary Bridging,Defense Evasion,no
-T1020.001,Traffic Duplication,Exfiltration,no
-T1557.002,ARP Cache Poisoning,Credential Access|Collection,Cleaver
-T1588.006,Vulnerabilities,Resource Development,Sandworm Team
-T1053.006,Systemd Timers,Execution|Persistence|Privilege Escalation,no
-T1562.008,Disable Cloud Logs,Defense Evasion,no
-T1547.012,Print Processors,Persistence|Privilege Escalation,no
-T1598.003,Spearphishing Link,Reconnaissance,Silent Librarian|Sidewinder|Sandworm Team|APT32|Kimsuky
-T1598.002,Spearphishing Attachment,Reconnaissance,Sidewinder
-T1598.001,Spearphishing Service,Reconnaissance,no
-T1598,Phishing for Information,Reconnaissance,ZIRCONIUM|APT28
-T1597.002,Purchase Technical Data,Reconnaissance,no
-T1597.001,Threat Intel Vendors,Reconnaissance,no
-T1597,Search Closed Sources,Reconnaissance,no
-T1596.005,Scan Databases,Reconnaissance,no
-T1596.004,CDNs,Reconnaissance,no
-T1596.003,Digital Certificates,Reconnaissance,no
-T1596.001,DNS/Passive DNS,Reconnaissance,no
-T1596.002,WHOIS,Reconnaissance,no
-T1596,Search Open Technical Databases,Reconnaissance,no
-T1595.002,Vulnerability Scanning,Reconnaissance,Volatile Cedar|APT28|Sandworm Team
-T1595.001,Scanning IP Blocks,Reconnaissance,no
-T1595,Active Scanning,Reconnaissance,no
-T1594,Search Victim-Owned Websites,Reconnaissance,Silent Librarian|Sandworm Team
-T1593.002,Search Engines,Reconnaissance,no
-T1593.001,Social Media,Reconnaissance,no
-T1593,Search Open Websites/Domains,Reconnaissance,Sandworm Team
-T1592.004,Client Configurations,Reconnaissance,HAFNIUM
-T1592.003,Firmware,Reconnaissance,no
-T1592.002,Software,Reconnaissance,Sandworm Team
-T1592.001,Hardware,Reconnaissance,no
-T1592,Gather Victim Host Information,Reconnaissance,no
-T1591.004,Identify Roles,Reconnaissance,no
-T1591.003,Identify Business Tempo,Reconnaissance,no
-T1591.001,Determine Physical Locations,Reconnaissance,no
-T1591.002,Business Relationships,Reconnaissance,Sandworm Team
-T1591,Gather Victim Org Information,Reconnaissance,no
-T1590.006,Network Security Appliances,Reconnaissance,no
-T1590.005,IP Addresses,Reconnaissance,HAFNIUM
-T1590.004,Network Topology,Reconnaissance,no
-T1590.003,Network Trust Dependencies,Reconnaissance,no
-T1590.002,DNS,Reconnaissance,no
-T1590.001,Domain Properties,Reconnaissance,Sandworm Team
-T1590,Gather Victim Network Information,Reconnaissance,HAFNIUM
-T1589.003,Employee Names,Reconnaissance,Silent Librarian|Sandworm Team
-T1589.002,Email Addresses,Reconnaissance,TA551|MuddyWater|HAFNIUM|APT32|Silent Librarian|Sandworm Team
-T1589.001,Credentials,Reconnaissance,APT28|Magic Hound|Chimera
-T1589,Gather Victim Identity Information,Reconnaissance,APT32
-T1588.005,Exploits,Resource Development,no
-T1588.004,Digital Certificates,Resource Development,Lazarus Group|Silent Librarian
-T1588.003,Code Signing Certificates,Resource Development,Wizard Spider
-T1588.002,Tool,Resource Development,MuddyWater|Silent Librarian|GALLIUM|Sandworm Team
-T1588.001,Malware,Resource Development,Turla|APT1
-T1588,Obtain Capabilities,Resource Development,no
-T1587.004,Exploits,Resource Development,no
-T1587.003,Digital Certificates,Resource Development,APT29|PROMETHIUM
-T1587.002,Code Signing Certificates,Resource Development,PROMETHIUM|Patchwork
-T1587.001,Malware,Resource Development,APT29|Lazarus Group|UNC2452|Sandworm Team|Turla|FIN7|Night Dragon|Cleaver
-T1587,Develop Capabilities,Resource Development,Kimsuky
-T1586.002,Email Accounts,Resource Development,Magic Hound|Kimsuky
-T1586.001,Social Media Accounts,Resource Development,no
-T1586,Compromise Accounts,Resource Development,no
-T1585.002,Email Accounts,Resource Development,Magic Hound|Silent Librarian|Sandworm Team|APT1
-T1585.001,Social Media Accounts,Resource Development,Fox Kitten|Sandworm Team|APT32|Cleaver
-T1585,Establish Accounts,Resource Development,Fox Kitten|APT17
-T1584.006,Web Services,Resource Development,Turla
-T1584.005,Botnet,Resource Development,no
-T1584.004,Server,Resource Development,Indrik Spider|Turla|APT16
-T1584.003,Virtual Private Server,Resource Development,Turla
-T1584.002,DNS Server,Resource Development,no
-T1584.001,Domains,Resource Development,APT29|UNC2452|APT1
-T1583.006,Web Services,Resource Development,ZIRCONIUM|MuddyWater|HAFNIUM|Lazarus Group|Turla|APT32|APT17|APT29
-T1583.005,Botnet,Resource Development,no
-T1583.004,Server,Resource Development,GALLIUM|Sandworm Team
-T1583.003,Virtual Private Server,Resource Development,HAFNIUM|TEMP.Veles
-T1583.002,DNS Server,Resource Development,no
-T1584,Compromise Infrastructure,Resource Development,no
-T1583.001,Domains,Resource Development,APT29|Mustang Panda|ZIRCONIUM|UNC2452|Lazarus Group|Silent Librarian|menuPass|Sandworm Team|APT32|Kimsuky|APT1|APT28
-T1583,Acquire Infrastructure,Resource Development,no
-T1564.007,VBA Stomping,Defense Evasion,no
-T1558.004,AS-REP Roasting,Credential Access,no
-T1580,Cloud Infrastructure Discovery,Discovery,no
-T1218.012,Verclsid,Defense Evasion,no
-T1205.001,Port Knocking,Defense Evasion|Persistence|Command And Control,PROMETHIUM
+T1205.001,Port Knocking,Defense Evasion|Persistence|Command And Control,no
 T1564.006,Run Virtual Instance,Defense Evasion,no
 T1564.005,Hidden File System,Defense Evasion,Strider|Equation
-T1556.003,Pluggable Authentication Modules,Credential Access|Defense Evasion|Persistence,no
+T1556.003,Pluggable Authentication Modules,Credential Access|Defense Evasion,no
 T1574.012,COR_PROFILER,Persistence|Privilege Escalation|Defense Evasion,Blue Mockingbird
 T1562.007,Disable or Modify Cloud Firewall,Defense Evasion,no
 T1098.004,SSH Authorized Keys,Persistence,no
 T1480.001,Environmental Keying,Defense Evasion,APT41|Equation
-T1059.007,JavaScript,Execution,MuddyWater|Turla|Higaisa|Sidewinder|Evilnum|Kimsuky|FIN6|APT32|FIN7|Cobalt Group|Molerats|TA505|Silence|Leafminer
+T1059.007,JavaScript/JScript,Execution,APT32|FIN7|Cobalt Group|Molerats|TA505|Silence|Leafminer
 T1578.004,Revert Cloud Instance,Defense Evasion,no
 T1578.003,Delete Cloud Instance,Defense Evasion,no
 T1578.001,Create Snapshot,Defense Evasion,no
 T1578.002,Create Cloud Instance,Defense Evasion,no
 T1127.001,MSBuild,Defense Evasion,Frankenstein
-T1027.005,Indicator Removal from Tools,Defense Evasion,Operation Wocao|GALLIUM|TEMP.Veles|Patchwork|APT3|Turla|OilRig|Deep Panda
+T1027.005,Indicator Removal from Tools,Defense Evasion,Soft Cell|TEMP.Veles|Patchwork|APT3|Turla|OilRig|Deep Panda
 T1562.006,Indicator Blocking,Defense Evasion,no
-T1573.002,Asymmetric Cryptography,Command And Control,Operation Wocao|Tropic Trooper|Cobalt Group|OilRig|FIN8|FIN6
-T1573.001,Symmetric Cryptography,Command And Control,Mustang Panda|Darkhotel|ZIRCONIUM|Higaisa|Frankenstein|Inception|APT28|APT33|BRONZE BUTLER|Stealth Falcon|Lazarus Group
+T1573.002,Asymmetric Cryptography,Command And Control,Tropic Trooper|Cobalt Group|OilRig|FIN8|FIN6
+T1573.001,Symmetric Cryptography,Command And Control,Frankenstein|Inception|APT28|APT33|BRONZE BUTLER|Stealth Falcon|Lazarus Group
 T1573,Encrypted Channel,Command And Control,Tropic Trooper
 T1027.004,Compile After Delivery,Defense Evasion,Gamaredon Group|Rocke|MuddyWater
 T1574.004,Dylib Hijacking,Persistence|Privilege Escalation|Defense Evasion,no
 T1546.015,Component Object Model Hijacking,Privilege Escalation|Persistence,APT28
-T1071.004,DNS,Command And Control,Chimera|APT39|Tropic Trooper|OilRig|Ke3chang|Cobalt Group|APT18|APT41|FIN7
-T1071.003,Mail Protocols,Command And Control,Turla|Kimsuky|APT32|SilverTerrier|APT28
-T1071.002,File Transfer Protocols,Command And Control,Kimsuky|APT41|SilverTerrier|Honeybee
-T1071.001,Web Protocols,Command And Control,APT29|Mustang Panda|Windshift|TA551|Higaisa|HAFNIUM|Sidewinder|Chimera|UNC2452|Sandworm Team|TA505|Rocke|APT39|Tropic Trooper|MuddyWater|Wizard Spider|Inception|APT41|SilverTerrier|APT28|WIRTE|APT33|FIN4|Night Dragon|APT18|APT38|Ke3chang|Orangeworm|APT19|Cobalt Group|Threat Group-3390|Rancor|APT37|Dark Caracal|Turla|Lazarus Group|BRONZE BUTLER|Magic Hound|APT32|OilRig|Gamaredon Group|Stealth Falcon
-T1572,Protocol Tunneling,Command And Control,Chimera|Fox Kitten|OilRig|Cobalt Group|FIN6
-T1048.003,Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol,Exfiltration,Wizard Spider|FIN6|APT32|APT33|Thrip|FIN8|OilRig|Lazarus Group
-T1048.002,Exfiltration Over Asymmetric Encrypted Non-C2 Protocol,Exfiltration,APT29|UNC2452
+T1071.004,DNS,Command And Control,APT39|Tropic Trooper|OilRig|Ke3chang|Cobalt Group|APT18|APT41|FIN7
+T1071.003,Mail Protocols,Command And Control,APT32|SilverTerrier|APT28
+T1071.002,File Transfer Protocols,Command And Control,APT41|SilverTerrier|Machete|Honeybee
+T1071.001,Web Protocols,Command And Control,Sandworm Team|TA505|Rocke|APT39|Tropic Trooper|MuddyWater|Wizard Spider|Inception|APT41|SilverTerrier|Machete|APT28|WIRTE|APT33|FIN4|Night Dragon|APT18|APT38|Cobalt Group|APT19|Threat Group-3390|Rancor|Orangeworm|APT37|Ke3chang|Dark Caracal|Turla|Lazarus Group|BRONZE BUTLER|APT32|OilRig|Magic Hound|Gamaredon Group|Stealth Falcon
+T1572,Protocol Tunneling,Command And Control,OilRig|Cobalt Group|FIN6
+T1048.003,Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol,Exfiltration,APT32|APT33|Thrip|FIN8|OilRig|Lazarus Group
+T1048.002,Exfiltration Over Asymmetric Encrypted Non-C2 Protocol,Exfiltration,no
 T1048.001,Exfiltration Over Symmetric Encrypted Non-C2 Protocol,Exfiltration,no
-T1001.003,Protocol Impersonation,Command And Control,Higaisa|Lazarus Group
-T1001.002,Steganography,Command And Control,APT29|Axiom
+T1001.003,Protocol Impersonation,Command And Control,Lazarus Group
+T1001.002,Steganography,Command And Control,Axiom
 T1001.001,Junk Data,Command And Control,APT28
 T1132.002,Non-Standard Encoding,Command And Control,no
-T1132.001,Standard Encoding,Command And Control,HAFNIUM|TA551|Sandworm Team|Tropic Trooper|MuddyWater|APT33|APT19|Lazarus Group|BRONZE BUTLER|Patchwork
+T1132.001,Standard Encoding,Command And Control,Sandworm Team|Tropic Trooper|MuddyWater|APT33|APT19|Lazarus Group|BRONZE BUTLER|Patchwork
 T1090.004,Domain Fronting,Command And Control,APT29
-T1090.003,Multi-hop Proxy,Command And Control,APT28|Operation Wocao|Inception|FIN4|APT29
-T1090.002,External Proxy,Command And Control,APT39|Silence|GALLIUM|MuddyWater|APT3|FIN5|Lazarus Group|menuPass|APT28
-T1090.001,Internal Proxy,Command And Control,APT29|Higaisa|UNC2452|Operation Wocao|APT39|Strider
+T1090.003,Multi-hop Proxy,Command And Control,Inception|FIN4|APT29
+T1090.002,External Proxy,Command And Control,APT39|Silence|Soft Cell|MuddyWater|APT3|FIN5|Lazarus Group|menuPass|APT28
+T1090.001,Internal Proxy,Command And Control,APT39|Strider
 T1102.003,One-Way Communication,Command And Control,Leviathan
-T1102.002,Bidirectional Communication,Command And Control,ZIRCONIUM|MuddyWater|APT28|APT29|Sandworm Team|APT39|APT12|FIN7|Turla|APT37|Magic Hound|Carbanak
+T1102.002,Bidirectional Communication,Command And Control,Sandworm Team|APT39|APT12|Turla|FIN7|APT37|Magic Hound|Carbanak
 T1102.001,Dead Drop Resolver,Command And Control,Rocke|APT41|BRONZE BUTLER|RTM|Patchwork
 T1571,Non-Standard Port,Command And Control,Sandworm Team|Rocke|DarkVishnya|Silence|APT-C-36|Magic Hound|APT33|APT32|TEMP.Veles|Lazarus Group|FIN7
-T1074.002,Remote Data Staging,Collection,APT29|Chimera|UNC2452|Threat Group-3390|menuPass|FIN6|Night Dragon|FIN8
-T1074.001,Local Data Staging,Collection,Mustang Panda|Sidewinder|Chimera|Kimsuky|APT39|Operation Wocao|GALLIUM|TEMP.Veles|Patchwork|Honeybee|Dragonfly 2.0|Leviathan|APT3|FIN5|menuPass|Lazarus Group|Threat Group-3390|APT28
+T1074.002,Remote Data Staging,Collection,Threat Group-3390|menuPass|FIN6|Night Dragon|FIN8
+T1074.001,Local Data Staging,Collection,Machete|Soft Cell|TEMP.Veles|Patchwork|Dragonfly 2.0|Honeybee|Leviathan|APT3|FIN5|menuPass|FIN6|Lazarus Group|Threat Group-3390|APT28
 T1078.004,Cloud Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,APT33
 T1564.004,NTFS File Attributes,Defense Evasion,APT32
-T1564.003,Hidden Window,Defense Evasion,Higaisa|Gorgon Group|Deep Panda|DarkHydrus|CopyKittens|APT19|APT32|APT28|APT3|Magic Hound
-T1078.003,Local Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,HAFNIUM|Turla|Operation Wocao|PROMETHIUM|Tropic Trooper|FIN10|Stolen Pencil|APT32
-T1078.002,Domain Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,Indrik Spider|Chimera|Operation Wocao|Sandworm Team|Wizard Spider|APT29|TA505|APT3|Threat Group-1314
+T1564.003,Hidden Window,Defense Evasion,Gorgon Group|Deep Panda|DarkHydrus|CopyKittens|APT19|APT32|APT28|APT3|Magic Hound
+T1078.003,Local Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,Tropic Trooper|FIN10|Stolen Pencil|APT32
+T1078.002,Domain Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,TA505|APT3|Threat Group-1314
 T1078.001,Default Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,no
 T1564.002,Hidden Users,Defense Evasion,no
-T1574.006,Dynamic Linker Hijacking,Persistence|Privilege Escalation|Defense Evasion,APT41|Rocke
-T1574.002,DLL Side-Loading,Persistence|Privilege Escalation|Defense Evasion,Mustang Panda|Higaisa|BlackTech|Sidewinder|Chimera|BRONZE BUTLER|Naikon|APT41|GALLIUM|Tropic Trooper|Patchwork|APT19|APT32|APT3|menuPass|Threat Group-3390
-T1574.001,DLL Search Order Hijacking,Persistence|Privilege Escalation|Defense Evasion,Evilnum|APT41|Whitefly|RTM|Threat Group-3390|menuPass
+T1574.006,LD_PRELOAD,Persistence|Privilege Escalation|Defense Evasion,Rocke
+T1574.002,DLL Side-Loading,Persistence|Privilege Escalation|Defense Evasion,BRONZE BUTLER|Naikon|APT41|Soft Cell|Tropic Trooper|Patchwork|APT19|APT32|APT3|menuPass|Threat Group-3390
+T1574.001,DLL Search Order Hijacking,Persistence|Privilege Escalation|Defense Evasion,Whitefly|RTM|Threat Group-3390|menuPass
 T1574.008,Path Interception by Search Order Hijacking,Persistence|Privilege Escalation|Defense Evasion,no
 T1574.007,Path Interception by PATH Environment Variable,Persistence|Privilege Escalation|Defense Evasion,no
 T1574.009,Path Interception by Unquoted Path,Persistence|Privilege Escalation|Defense Evasion,no
@@ -184,174 +61,174 @@ T1574.011,Services Registry Permissions Weakness,Persistence|Privilege Escalatio
 T1574.005,Executable Installer File Permissions Weakness,Persistence|Privilege Escalation|Defense Evasion,no
 T1574.010,Services File Permissions Weakness,Persistence|Privilege Escalation|Defense Evasion,no
 T1574,Hijack Execution Flow,Persistence|Privilege Escalation|Defense Evasion,no
-T1069.001,Local Groups,Discovery,Chimera|Operation Wocao|Turla|OilRig|admin@338
-T1570,Lateral Tool Transfer,Lateral Movement,Chimera|GALLIUM|Operation Wocao|APT32|Wizard Spider|Turla|FIN10
+T1069.001,Local Groups,Discovery,Turla|OilRig|admin@338
+T1570,Lateral Tool Transfer,Lateral Movement,APT32|Wizard Spider|Turla|FIN10
 T1568.003,DNS Calculation,Command And Control,APT12
-T1204.002,Malicious File,Execution,Ajax Security Team|Mustang Panda|TA551|Higaisa|Sidewinder|Kimsuky|FIN6|PROMETHIUM|APT30|Windshift|APT33|Sandworm Team|Naikon|Whitefly|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Wizard Spider|Mofang|Frankenstein|RTM|Inception|BlackTech|APT-C-36|Machete|admin@338|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|Dragonfly 2.0|Dark Caracal|Cobalt Group|DarkHydrus|OilRig|Rancor|BRONZE BUTLER|FIN7|APT19|Patchwork|APT32|Gorgon Group|MuddyWater|Lazarus Group|APT37|TA459|Leviathan|APT29|APT28|FIN8|Elderwood|PLATINUM|menuPass
-T1204.001,Malicious Link,Execution,APT28|APT29|Mustang Panda|Sidewinder|ZIRCONIUM|MuddyWater|Evilnum|Sandworm Team|Wizard Spider|Patchwork|Windshift|APT32|Molerats|Mofang|BlackTech|TA505|OilRig|Machete|Leviathan|FIN8|FIN4|Elderwood|Dragonfly 2.0|Cobalt Group|APT39|Night Dragon|Turla|APT33
+T1204.002,Malicious File,Execution,Magic Hound|Windshift|APT33|Sandworm Team|Naikon|Whitefly|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Wizard Spider|Mofang|Frankenstein|RTM|Inception|BlackTech|APT-C-36|Machete|admin@338|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|APT19|Dragonfly 2.0|BRONZE BUTLER|Cobalt Group|DarkHydrus|Gorgon Group|Patchwork|OilRig|Dark Caracal|MuddyWater|Lazarus Group|FIN7|APT32|Rancor|APT37|FIN8|APT28|Elderwood|TA459|APT29|Leviathan|menuPass|PLATINUM
+T1204.001,Malicious Link,Execution,Patchwork|Windshift|APT32|Molerats|Mofang|BlackTech|TA505|OilRig|Machete|Leviathan|FIN8|FIN4|Elderwood|Dragonfly 2.0|Cobalt Group|APT39|Night Dragon|APT33|Turla
 T1195.003,Compromise Hardware Supply Chain,Initial Access,no
-T1195.002,Compromise Software Supply Chain,Initial Access,APT29|UNC2452|Cobalt Group|GOLD SOUTHFIELD|Dragonfly|Sandworm Team|APT41
+T1195.002,Compromise Software Supply Chain,Initial Access,Sandworm Team|APT41
 T1195.001,Compromise Software Dependencies and Development Tools,Initial Access,no
-T1568.001,Fast Flux DNS,Command And Control,menuPass|TA505
-T1052.001,Exfiltration over USB,Exfiltration,Mustang Panda|Tropic Trooper
-T1569.002,Service Execution,Execution,Chimera|Operation Wocao|Wizard Spider|Blue Mockingbird|APT39|APT41|Silence|FIN6|APT32|Honeybee|Ke3chang
+T1568.001,Fast Flux DNS,Command And Control,TA505
+T1052.001,Exfiltration over USB,Exfiltration,Tropic Trooper
+T1569.002,Service Execution,Execution,Blue Mockingbird|APT39|APT41|Silence|FIN6|APT32|Honeybee|Ke3chang
 T1569.001,Launchctl,Execution,no
 T1569,System Services,Execution,no
-T1568.002,Domain Generation Algorithms,Command And Control,TA551|APT41
-T1568,Dynamic Resolution,Command And Control,APT29|UNC2452
+T1568.002,Domain Generation Algorithms,Command And Control,APT41
+T1568,Dynamic Resolution,Command And Control,no
 T1011.001,Exfiltration Over Bluetooth,Exfiltration,no
-T1567.002,Exfiltration to Cloud Storage,Exfiltration,ZIRCONIUM|HAFNIUM|Chimera|Leviathan|Turla
+T1567.002,Exfiltration to Cloud Storage,Exfiltration,Leviathan|Turla
 T1567.001,Exfiltration to Code Repository,Exfiltration,no
-T1059.006,Python,Execution,ZIRCONIUM|MuddyWater|Turla|Operation Wocao|Kimsuky|APT29|Rocke|BRONZE BUTLER|APT39|Dragonfly 2.0|Machete
-T1059.005,Visual Basic,Execution,Mustang Panda|Windshift|Higaisa|Sidewinder|APT39|Machete|Operation Wocao|Kimsuky|Lazarus Group|APT33|Sandworm Team|Gamaredon Group|Sharpshooter|Molerats|Frankenstein|Inception|APT-C-36|Rancor|Patchwork|MuddyWater|Honeybee|FIN7|APT37|BRONZE BUTLER|APT32|Turla|TA505|Silence|WIRTE|FIN4|Cobalt Group|Gorgon Group|Leviathan|TA459|Magic Hound
+T1059.006,Python,Execution,Rocke|BRONZE BUTLER|APT39|Dragonfly 2.0|Machete
+T1059.005,Visual Basic,Execution,APT33|Sandworm Team|Gamaredon Group|Sharpshooter|Molerats|Frankenstein|Inception|APT-C-36|Rancor|Patchwork|MuddyWater|Honeybee|FIN7|APT37|BRONZE BUTLER|APT32|Turla|TA505|Silence|WIRTE|FIN4|Cobalt Group|Gorgon Group|Leviathan|TA459|Magic Hound
 T1059.004,Unix Shell,Execution,Rocke|APT41
-T1059.003,Windows Command Shell,Execution,APT29|Mustang Panda|ZIRCONIUM|TA551|Higaisa|Indrik Spider|Chimera|UNC2452|Fox Kitten|Machete|Operation Wocao|Wizard Spider|FIN6|TA505|Blue Mockingbird|Tropic Trooper|Frankenstein|OilRig|Lazarus Group|Honeybee|Cobalt Group|FIN7|APT41|GALLIUM|Turla|Silence|APT32|Darkhotel|MuddyWater|APT18|APT38|Dragonfly 2.0|Rancor|Gorgon Group|Ke3chang|Dark Caracal|Leviathan|APT37|APT28|FIN8|Magic Hound|Sowbug|BRONZE BUTLER|FIN10|Threat Group-3390|menuPass|Gamaredon Group|Patchwork|Suckfly|Threat Group-1314|APT3|admin@338|APT1
+T1059.003,Windows Command Shell,Execution,TA505|Blue Mockingbird|Tropic Trooper|Frankenstein|OilRig|Lazarus Group|Honeybee|Cobalt Group|FIN7|APT41|Soft Cell|Turla|Silence|APT32|APT39|Darkhotel|MuddyWater|APT18|APT38|Dark Caracal|Gorgon Group|Dragonfly 2.0|Rancor|Ke3chang|APT37|Leviathan|FIN8|APT28|Magic Hound|Sowbug|BRONZE BUTLER|FIN10|Threat Group-3390|menuPass|Gamaredon Group|Suckfly|Patchwork|Threat Group-1314|APT3|admin@338|APT1
 T1059.002,AppleScript,Execution,no
-T1059.001,PowerShell,Execution,Mustang Panda|Indrik Spider|HAFNIUM|Sidewinder|UNC2452|Fox Kitten|GOLD SOUTHFIELD|Sandworm Team|Operation Wocao|Lazarus Group|Chimera|Blue Mockingbird|APT39|DarkVishnya|Molerats|Wizard Spider|Frankenstein|Inception|Silence|APT41|Kimsuky|GALLIUM|TA505|WIRTE|TEMP.Veles|APT33|Gallmaker|APT28|Thrip|Cobalt Group|Turla|APT19|Dragonfly 2.0|Gorgon Group|DarkHydrus|Leviathan|TA459|MuddyWater|FIN8|OilRig|Magic Hound|BRONZE BUTLER|CopyKittens|APT32|FIN10|menuPass|Threat Group-3390|FIN7|Patchwork|Stealth Falcon|FIN6|Poseidon Group|APT3|APT29|Deep Panda
-T1567,Exfiltration Over Web Service,Exfiltration,APT28
+T1059.001,PowerShell,Execution,Blue Mockingbird|APT39|DarkVishnya|Molerats|Wizard Spider|Frankenstein|Inception|Silence|APT41|Kimsuky|Soft Cell|TA505|WIRTE|TEMP.Veles|APT33|Gallmaker|Turla|APT19|DarkHydrus|APT28|Thrip|Gorgon Group|Cobalt Group|Dragonfly 2.0|Leviathan|TA459|FIN8|MuddyWater|Magic Hound|OilRig|BRONZE BUTLER|CopyKittens|APT32|FIN7|FIN10|Threat Group-3390|menuPass|Patchwork|Stealth Falcon|FIN6|Poseidon Group|APT3|APT29|Deep Panda
+T1567,Exfiltration Over Web Service,Exfiltration,no
 T1497.003,Time Based Evasion,Defense Evasion|Discovery,no
-T1497.002,User Activity Based Checks,Defense Evasion|Discovery,Darkhotel|FIN7
-T1497.001,System Checks,Defense Evasion|Discovery,Darkhotel|Evilnum|Frankenstein
+T1497.002,User Activity Based Checks,Defense Evasion|Discovery,FIN7
+T1497.001,System Checks,Defense Evasion|Discovery,Frankenstein
 T1498.002,Reflection Amplification,Impact,no
 T1498.001,Direct Network Flood,Impact,no
-T1566.003,Spearphishing via Service,Initial Access,Ajax Security Team|Lazarus Group|Magic Hound|Windshift|FIN6|OilRig|Dark Caracal
-T1566.002,Spearphishing Link,Initial Access,Mustang Panda|ZIRCONIUM|MuddyWater|Sidewinder|Evilnum|Sandworm Team|Wizard Spider|APT1|Windshift|Molerats|Mofang|BlackTech|Machete|Kimsuky|TA505|Stolen Pencil|APT39|FIN4|APT32|Night Dragon|Cobalt Group|Turla|APT28|Dragonfly 2.0|OilRig|APT29|APT33|Leviathan|FIN8|Elderwood|Patchwork|Magic Hound
-T1566.001,Spearphishing Attachment,Initial Access,Ajax Security Team|Mustang Panda|TA551|Higaisa|Sidewinder|APT1|FIN6|APT30|Windshift|APT33|Sandworm Team|Naikon|Gamaredon Group|Sharpshooter|Molerats|Mofang|Wizard Spider|RTM|Frankenstein|Inception|BlackTech|APT-C-36|APT41|Machete|admin@338|Kimsuky|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|Tropic Trooper|OilRig|BRONZE BUTLER|Cobalt Group|FIN7|APT19|Gorgon Group|Rancor|APT32|DarkHydrus|Lazarus Group|Dragonfly 2.0|MuddyWater|APT28|FIN8|Elderwood|APT37|menuPass|TA459|PLATINUM|APT29|Leviathan|Patchwork
-T1566,Phishing,Initial Access,GOLD SOUTHFIELD|Dragonfly
+T1566.003,Spearphishing via Service,Initial Access,Magic Hound|Windshift|FIN6|OilRig|Dark Caracal
+T1566.002,Spearphishing Link,Initial Access,Windshift|Molerats|Mofang|BlackTech|Machete|Kimsuky|TA505|Stolen Pencil|APT39|FIN4|APT32|Night Dragon|Turla|APT28|Cobalt Group|Dragonfly 2.0|OilRig|APT33|Elderwood|Leviathan|Magic Hound|Patchwork|APT29|FIN8
+T1566.001,Spearphishing Attachment,Initial Access,Magic Hound|Windshift|APT33|Sandworm Team|Naikon|Gamaredon Group|Sharpshooter|Molerats|Mofang|Wizard Spider|RTM|Frankenstein|Inception|BlackTech|APT-C-36|APT41|Machete|admin@338|Kimsuky|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|Tropic Trooper|Turla|Gorgon Group|Rancor|DarkHydrus|Cobalt Group|FIN7|OilRig|Lazarus Group|APT19|Dragonfly 2.0|BRONZE BUTLER|APT32|FIN8|MuddyWater|APT28|TA459|Leviathan|Patchwork|PLATINUM|Elderwood|APT29|APT37|menuPass
+T1566,Phishing,Initial Access,no
 T1565.003,Runtime Data Manipulation,Impact,APT38
 T1565.002,Transmitted Data Manipulation,Impact,APT38
 T1565.001,Stored Data Manipulation,Impact,FIN4|APT38
 T1565,Data Manipulation,Impact,no
-T1564.001,Hidden Files and Directories,Defense Evasion,Mustang Panda|Rocke|APT32|Tropic Trooper|APT28|Lazarus Group
+T1564.001,Hidden Files and Directories,Defense Evasion,Rocke|APT32|Tropic Trooper|APT28|Lazarus Group
 T1564,Hide Artifacts,Defense Evasion,no
 T1563.002,RDP Hijacking,Lateral Movement,no
 T1563.001,SSH Hijacking,Lateral Movement,no
 T1563,Remote Service Session Hijacking,Lateral Movement,no
-T1518.001,Security Software Discovery,Discovery,Windshift|Sidewinder|Operation Wocao|Wizard Spider|Turla|Rocke|Frankenstein|The White Company|Cobalt Group|Darkhotel|MuddyWater|Tropic Trooper|FIN8|Patchwork|Naikon
+T1518.001,Security Software Discovery,Discovery,Turla|Rocke|Frankenstein|The White Company|Cobalt Group|Darkhotel|MuddyWater|Tropic Trooper|FIN8|Patchwork|Naikon
 T1069.003,Cloud Groups,Discovery,no
-T1069.002,Domain Groups,Discovery,Turla|Inception|OilRig|Dragonfly 2.0|Ke3chang
+T1069.002,Domain Groups,Discovery,Turla|Wizard Spider|Inception|OilRig|FIN6|Dragonfly 2.0|Ke3chang
 T1087.004,Cloud Account,Discovery,no
 T1087.003,Email Account,Discovery,Sandworm Team|TA505
-T1087.002,Domain Account,Discovery,MuddyWater|Fox Kitten|Operation Wocao|Wizard Spider|Chimera|Turla|Sandworm Team|Dragonfly 2.0|OilRig|BRONZE BUTLER|menuPass|FIN6|Poseidon Group|Ke3chang
-T1087.001,Local Account,Discovery,Chimera|Fox Kitten|Turla|Poseidon Group|OilRig|Ke3chang|APT32|APT1|Threat Group-3390|APT3|admin@338
+T1087.002,Domain Account,Discovery,Turla|Sandworm Team|Dragonfly 2.0|OilRig|BRONZE BUTLER|menuPass|FIN6|Poseidon Group|Ke3chang
+T1087.001,Local Account,Discovery,Turla|Poseidon Group|OilRig|Ke3chang|APT32|APT1|Threat Group-3390|APT3|admin@338
 T1553.004,Install Root Certificate,Defense Evasion,no
-T1562.004,Disable or Modify System Firewall,Defense Evasion,APT29|UNC2452|Operation Wocao|Rocke|Lazarus Group|Kimsuky|Dragonfly 2.0|Carbanak
-T1562.003,Impair Command History Logging,Defense Evasion,no
-T1562.002,Disable Windows Event Logging,Defense Evasion,APT29|UNC2452|Threat Group-3390
-T1562.001,Disable or Modify Tools,Defense Evasion,APT29|MuddyWater|UNC2452|Wizard Spider|FIN6|Gamaredon Group|BRONZE BUTLER|Rocke|Kimsuky|Turla|Night Dragon|Gorgon Group|Lazarus Group|Putter Panda
+T1562.004,Disable or Modify System Firewall,Defense Evasion,Rocke|Lazarus Group|Kimsuky|Dragonfly 2.0|Carbanak
+T1562.003,HISTCONTROL,Defense Evasion,no
+T1562.002,Disable Windows Event Logging,Defense Evasion,Threat Group-3390
+T1562.001,Disable or Modify Tools,Defense Evasion,Gamaredon Group|BRONZE BUTLER|Rocke|Kimsuky|Turla|Night Dragon|Gorgon Group|Lazarus Group|Putter Panda
 T1562,Impair Defenses,Defense Evasion,no
 T1003.004,LSA Secrets,Credential Access,OilRig|MuddyWater|menuPass|Leafminer|Ke3chang|Dragonfly 2.0|APT33|Threat Group-3390
 T1003.005,Cached Domain Credentials,Credential Access,OilRig|MuddyWater|Leafminer|APT33
 T1561.002,Disk Structure Wipe,Impact,Sandworm Team|Lazarus Group|APT38|APT37
 T1561.001,Disk Content Wipe,Impact,Lazarus Group
 T1561,Disk Wipe,Impact,no
-T1560.003,Archive via Custom Method,Collection,Mustang Panda|Lazarus Group|Kimsuky|CopyKittens|FIN6
+T1560.003,Archive via Custom Method,Collection,Lazarus Group|Kimsuky|CopyKittens|FIN6
 T1560.002,Archive via Library,Collection,Lazarus Group|Threat Group-3390
-T1560.001,Archive via Utility,Collection,APT29|Mustang Panda|HAFNIUM|UNC2452|Fox Kitten|Operation Wocao|Chimera|APT41|GALLIUM|Turla|Gallmaker|APT33|APT39|MuddyWater|Magic Hound|FIN8|BRONZE BUTLER|CopyKittens|Sowbug|APT3|menuPass|APT1|Ke3chang
+T1560.001,Archive via Utility,Collection,APT41|Soft Cell|Turla|Gallmaker|APT33|APT39|MuddyWater|Magic Hound|FIN8|BRONZE BUTLER|CopyKittens|APT3|Sowbug|menuPass|APT1|Ke3chang
 T1560,Archive Collected Data,Collection,menuPass|APT32|Honeybee|Patchwork|APT28|Dragonfly 2.0|FIN6|Lazarus Group|Ke3chang
 T1499.004,Application or System Exploitation,Impact,no
 T1499.003,Application Exhaustion Flood,Impact,no
 T1499.002,Service Exhaustion Flood,Impact,no
 T1499.001,OS Exhaustion Flood,Impact,no
-T1491.002,External Defacement,Impact,Sandworm Team
+T1491.002,External Defacement,Impact,no
 T1491.001,Internal Defacement,Impact,Lazarus Group
-T1114.003,Email Forwarding Rule,Collection,Silent Librarian|Kimsuky
-T1114.002,Remote Email Collection,Collection,APT29|HAFNIUM|Chimera|UNC2452|APT1|FIN4|Dragonfly 2.0|APT28|Leafminer|Ke3chang
-T1114.001,Local Email Collection,Collection,Chimera|Magic Hound|APT1
+T1114.003,Email Forwarding Rule,Collection,no
+T1114.002,Remote Email Collection,Collection,APT1|FIN4|APT28|Dragonfly 2.0|Ke3chang|Leafminer
+T1114.001,Local Email Collection,Collection,Magic Hound|APT1
 T1134.005,SID-History Injection,Defense Evasion|Privilege Escalation,no
 T1134.004,Parent PID Spoofing,Defense Evasion|Privilege Escalation,no
 T1134.003,Make and Impersonate Token,Defense Evasion|Privilege Escalation,no
 T1134.002,Create Process with Token,Defense Evasion|Privilege Escalation,Turla|Lazarus Group
 T1134.001,Token Impersonation/Theft,Defense Evasion|Privilege Escalation,APT28
-T1213.002,Sharepoint,Collection,Chimera|Ke3chang|APT28
+T1213.002,Sharepoint,Collection,Ke3chang|APT28
 T1213.001,Confluence,Collection,no
-T1555.003,Credentials from Web Browsers,Credential Access,Ajax Security Team|ZIRCONIUM|FIN6|Sandworm Team|Inception|Stealth Falcon|OilRig|Leafminer|APT33|APT3|Kimsuky|TA505|Stolen Pencil|MuddyWater|APT37|Patchwork|Molerats
+T1555.003,Credentials from Web Browsers,Credential Access,Magic Hound|Sandworm Team|Inception|Stealth Falcon|OilRig|Leafminer|APT33|APT3|Kimsuky|TA505|Stolen Pencil|MuddyWater|APT37|Patchwork|Molerats
 T1555.002,Securityd Memory,Credential Access,no
 T1555.001,Keychain,Credential Access,no
-T1559.002,Dynamic Data Exchange,Execution,Sidewinder|Sharpshooter|TA505|MuddyWater|Gallmaker|Cobalt Group|Patchwork|APT37|APT28|FIN7
+T1559.002,Dynamic Data Exchange,Execution,Sharpshooter|TA505|MuddyWater|Gallmaker|Patchwork|Cobalt Group|APT37|APT28|FIN7
 T1559.001,Component Object Model,Execution,Gamaredon Group|MuddyWater
 T1559,Inter-Process Communication,Execution,no
 T1558.002,Silver Ticket,Credential Access,no
 T1558.001,Golden Ticket,Credential Access,Ke3chang
 T1558,Steal or Forge Kerberos Tickets,Credential Access,no
-T1557.001,LLMNR/NBT-NS Poisoning and SMB Relay,Credential Access|Collection,Wizard Spider
-T1557,Man-in-the-Middle,Credential Access|Collection,Kimsuky
-T1556.002,Password Filter DLL,Credential Access|Defense Evasion|Persistence,Strider
-T1556.001,Domain Controller Authentication,Credential Access|Defense Evasion|Persistence,Chimera
-T1556,Modify Authentication Process,Credential Access|Defense Evasion|Persistence,no
+T1557.001,LLMNR/NBT-NS Poisoning and SMB Relay,Credential Access|Collection,no
+T1557,Man-in-the-Middle,Credential Access|Collection,no
+T1556.002,Password Filter DLL,Credential Access|Defense Evasion,Strider
+T1556.001,Domain Controller Authentication,Credential Access|Defense Evasion,no
+T1556,Modify Authentication Process,Credential Access|Defense Evasion,no
 T1056.004,Credential API Hooking,Collection|Credential Access,PLATINUM
 T1056.003,Web Portal Capture,Collection|Credential Access,no
 T1056.002,GUI Input Capture,Collection|Credential Access,FIN4
-T1056.001,Keylogging,Collection|Credential Access,Ajax Security Team|Operation Wocao|APT32|Sandworm Team|APT39|APT41|Kimsuky|menuPass|Stolen Pencil|FIN4|APT38|OilRig|Ke3chang|PLATINUM|Sowbug|Magic Hound|Group5|Lazarus Group|Threat Group-3390|APT3|Darkhotel|APT28
-T1555,Credentials from Password Stores,Credential Access,APT29|Evilnum|UNC2452|FIN6|APT39|OilRig|MuddyWater|Leafminer|APT33|Stealth Falcon
+T1056.001,Keylogging,Collection|Credential Access,APT32|Sandworm Team|APT39|APT41|Kimsuky|menuPass|Stolen Pencil|FIN4|APT38|Ke3chang|OilRig|PLATINUM|Sowbug|Magic Hound|Group5|Lazarus Group|Threat Group-3390|APT3|Darkhotel|APT28
+T1555,Credentials from Password Stores,Credential Access,APT39|OilRig|MuddyWater|Leafminer|APT33|Turla|Stealth Falcon
 T1552.005,Cloud Instance Metadata API,Credential Access,no
 T1003.008,/etc/passwd and /etc/shadow,Credential Access,no
 T1003.007,Proc Filesystem,Credential Access,no
-T1003.006,DCSync,Credential Access,APT29|UNC2452|Operation Wocao
-T1558.003,Kerberoasting,Credential Access,APT29|UNC2452|Operation Wocao|Wizard Spider
+T1003.006,DCSync,Credential Access,no
+T1558.003,Kerberoasting,Credential Access,no
 T1552.006,Group Policy Preferences,Credential Access,APT33
-T1003.003,NTDS,Credential Access,Mustang Panda|HAFNIUM|Fox Kitten|menuPass|Wizard Spider|Chimera|FIN6|Dragonfly 2.0
-T1003.002,Security Account Manager,Credential Access,Wizard Spider|Threat Group-3390|Ke3chang|GALLIUM|Night Dragon|Dragonfly 2.0|menuPass
-T1003.001,LSASS Memory,Credential Access,HAFNIUM|Fox Kitten|Operation Wocao|Kimsuky|Sandworm Team|Whitefly|Blue Mockingbird|Silence|Threat Group-3390|Leviathan|APT41|GALLIUM|TEMP.Veles|APT33|APT39|Stolen Pencil|APT32|Leafminer|Magic Hound|Lazarus Group|PLATINUM|FIN8|MuddyWater|BRONZE BUTLER|OilRig|FIN6|APT3|APT28|APT1|Ke3chang|Cleaver
-T1110.004,Credential Stuffing,Credential Access,Chimera
-T1110.003,Password Spraying,Credential Access,Silent Librarian|Chimera|APT28|APT33|Leafminer|Lazarus Group
-T1110.002,Password Cracking,Credential Access,FIN6|APT41|Dragonfly 2.0|APT3
-T1110.001,Password Guessing,Credential Access,APT28
-T1021.006,Windows Remote Management,Lateral Movement,APT29|UNC2452|Chimera|Wizard Spider|Threat Group-3390
-T1021.005,VNC,Lateral Movement,Fox Kitten|GCMAN
-T1021.004,SSH,Lateral Movement,Fox Kitten|Rocke|TEMP.Veles|Leviathan|APT39|OilRig|menuPass|GCMAN
+T1003.003,NTDS,Credential Access,FIN6|Dragonfly 2.0
+T1003.002,Security Account Manager,Credential Access,Threat Group-3390|Ke3chang|Soft Cell|Night Dragon|Dragonfly 2.0|menuPass
+T1003.001,LSASS Memory,Credential Access,Sandworm Team|Whitefly|Blue Mockingbird|Silence|Threat Group-3390|Leviathan|APT41|Soft Cell|TEMP.Veles|APT33|APT39|Stolen Pencil|APT32|Lazarus Group|Leafminer|Magic Hound|MuddyWater|PLATINUM|FIN8|BRONZE BUTLER|OilRig|FIN6|APT3|APT28|APT1|Ke3chang|Cleaver
+T1110.004,Credential Stuffing,Credential Access,no
+T1110.003,Password Spraying,Credential Access,APT33|Leafminer|Lazarus Group
+T1110.002,Password Cracking,Credential Access,APT41|Dragonfly 2.0|APT3
+T1110.001,Password Guessing,Credential Access,no
+T1021.006,Windows Remote Management,Lateral Movement,Threat Group-3390
+T1021.005,VNC,Lateral Movement,GCMAN
+T1021.004,SSH,Lateral Movement,Rocke|TEMP.Veles|Leviathan|APT39|OilRig|menuPass|GCMAN
 T1021.003,Distributed Component Object Model,Lateral Movement,no
-T1021.002,SMB/Windows Admin Shares,Lateral Movement,Fox Kitten|APT41|Operation Wocao|Wizard Spider|Chimera|Blue Mockingbird|APT39|APT32|Orangeworm|FIN8|APT3|Lazarus Group|Threat Group-1314|Turla|Deep Panda|Ke3chang
-T1021.001,Remote Desktop Protocol,Lateral Movement,Fox Kitten|Chimera|Blue Mockingbird|Wizard Spider|Silence|APT41|TEMP.Veles|Leviathan|APT39|Stolen Pencil|Cobalt Group|Dragonfly 2.0|FIN8|APT3|OilRig|FIN10|menuPass|Patchwork|FIN6|Lazarus Group|APT1|Axiom
+T1021.002,SMB/Windows Admin Shares,Lateral Movement,Blue Mockingbird|APT39|APT32|Orangeworm|FIN8|APT3|Lazarus Group|Threat Group-1314|Turla|Deep Panda|Ke3chang
+T1021.001,Remote Desktop Protocol,Lateral Movement,Blue Mockingbird|Wizard Spider|Silence|APT41|TEMP.Veles|Leviathan|APT39|Stolen Pencil|Cobalt Group|Dragonfly 2.0|FIN8|APT3|OilRig|menuPass|FIN10|Patchwork|FIN6|Lazarus Group|APT1|Axiom
 T1554,Compromise Client Software Binary,Persistence,no
 T1036.006,Space after Filename,Defense Evasion,no
-T1036.005,Match Legitimate Name or Location,Defense Evasion,APT29|Mustang Panda|Sidewinder|Darkhotel|Lazarus Group|Indrik Spider|UNC2452|Fox Kitten|Machete|Chimera|PROMETHIUM|Rocke|Sandworm Team|APT39|Blue Mockingbird|Whitefly|Tropic Trooper|Silence|APT41|menuPass|TEMP.Veles|MuddyWater|BRONZE BUTLER|Sowbug|APT32|Patchwork|Poseidon Group|admin@338|Carbanak|APT1
-T1036.004,Masquerade Task or Service,Defense Evasion,ZIRCONIUM|APT29|Higaisa|UNC2452|Fox Kitten|Kimsuky|Lazarus Group|PROMETHIUM|Wizard Spider|APT-C-36|Carbanak|APT32|FIN6|FIN7
-T1036.003,Rename System Utilities,Defense Evasion,menuPass|APT32|GALLIUM
+T1036.005,Match Legitimate Name or Location,Defense Evasion,Rocke|Sandworm Team|APT39|Blue Mockingbird|Whitefly|Tropic Trooper|Silence|APT41|menuPass|TEMP.Veles|MuddyWater|BRONZE BUTLER|Sowbug|APT32|Patchwork|Poseidon Group|admin@338|Carbanak|APT1
+T1036.004,Masquerade Task or Service,Defense Evasion,Wizard Spider|APT-C-36|Carbanak|APT32|FIN6|FIN7
+T1036.003,Rename System Utilities,Defense Evasion,menuPass|APT32|Soft Cell|PLATINUM
 T1036.002,Right-to-Left Override,Defense Evasion,BRONZE BUTLER|BlackTech|Ke3chang|Scarlet Mimic
-T1036.001,Invalid Code Signature,Defense Evasion,Windshift|APT37
+T1036.001,Invalid Code Signature,Defense Evasion,Windshift
 T1553.003,SIP and Trust Provider Hijacking,Defense Evasion,no
-T1553.002,Code Signing,Defense Evasion,APT29|GALLIUM|UNC2452|Wizard Spider|Kimsuky|PROMETHIUM|Patchwork|Silence|APT41|FIN6|TA505|FIN7|Honeybee|Leviathan|CopyKittens|Winnti Group|Suckfly|Molerats|Darkhotel
+T1553.002,Code Signing,Defense Evasion,Patchwork|Silence|APT41|FIN6|TA505|FIN7|Honeybee|Leviathan|APT37|CopyKittens|Winnti Group|Suckfly|Molerats|Darkhotel
 T1553.001,Gatekeeper Bypass,Defense Evasion,no
 T1553,Subvert Trust Controls,Defense Evasion,no
-T1027.003,Steganography,Defense Evasion,TA551|BRONZE BUTLER|Tropic Trooper|MuddyWater|APT37
-T1027.002,Software Packing,Defense Evasion,ZIRCONIUM|Lazarus Group|TA505|Rocke|GALLIUM|The White Company|APT39|APT38|Dark Caracal|Elderwood|APT3|Patchwork|APT29|Night Dragon
-T1027.001,Binary Padding,Defense Evasion,Mustang Panda|Higaisa|Gamaredon Group|APT32|Patchwork|Leviathan|BRONZE BUTLER|Moafee
+T1027.003,Steganography,Defense Evasion,BRONZE BUTLER|Tropic Trooper|MuddyWater|APT37
+T1027.002,Software Packing,Defense Evasion,TA505|Rocke|Soft Cell|The White Company|APT39|APT38|Dark Caracal|Elderwood|APT3|Patchwork|APT29|Night Dragon
+T1027.001,Binary Padding,Defense Evasion,Gamaredon Group|Patchwork|APT32|Leviathan|BRONZE BUTLER|Moafee
 T1222.002,Linux and Mac File and Directory Permissions Modification,Defense Evasion,Rocke|APT32
-T1222.001,Windows File and Directory Permissions Modification,Defense Evasion,Wizard Spider
-T1552.004,Private Keys,Credential Access,APT29|UNC2452|Operation Wocao|Rocke
+T1222.001,Windows File and Directory Permissions Modification,Defense Evasion,no
+T1552.004,Private Keys,Credential Access,Rocke
 T1552.003,Bash History,Credential Access,no
 T1552.002,Credentials in Registry,Credential Access,APT32
-T1552.001,Credentials In Files,Credential Access,Fox Kitten|Leafminer|APT33|OilRig|TA505|Stolen Pencil|MuddyWater|APT3
+T1552.001,Credentials In Files,Credential Access,Leafminer|APT33|OilRig|TA505|Stolen Pencil|MuddyWater|APT3
 T1552,Unsecured Credentials,Credential Access,no
 T1216.001,PubPrn,Defense Evasion,APT32
-T1070.006,Timestomp,Defense Evasion,APT29|UNC2452|Chimera|Kimsuky|Rocke|TEMP.Veles|APT32|Lazarus Group|APT28
+T1070.006,Timestomp,Defense Evasion,Rocke|TEMP.Veles|APT32|Lazarus Group|APT28
 T1070.005,Network Share Connection Removal,Defense Evasion,Threat Group-3390
-T1070.004,File Deletion,Defense Evasion,APT39|Mustang Panda|Chimera|Evilnum|UNC2452|Operation Wocao|FIN6|Sandworm Team|Rocke|Tropic Trooper|Gamaredon Group|Wizard Spider|APT41|Kimsuky|Silence|The White Company|TEMP.Veles|APT32|APT38|Honeybee|Patchwork|Cobalt Group|Dragonfly 2.0|menuPass|FIN8|FIN5|BRONZE BUTLER|OilRig|APT3|Magic Hound|APT28|FIN10|Threat Group-3390|Group5|Lazarus Group|APT18|APT29
+T1070.004,File Deletion,Defense Evasion,Sandworm Team|Rocke|Tropic Trooper|Gamaredon Group|Wizard Spider|APT41|Kimsuky|Silence|The White Company|TEMP.Veles|APT32|APT38|Patchwork|Honeybee|Cobalt Group|Dragonfly 2.0|menuPass|FIN8|OilRig|FIN5|BRONZE BUTLER|Magic Hound|APT3|FIN10|APT28|Threat Group-3390|Group5|Lazarus Group|APT18|APT29
 T1070.003,Clear Command History,Defense Evasion,APT41
-T1550.004,Web Session Cookie,Defense Evasion|Lateral Movement,APT29|UNC2452
+T1550.004,Web Session Cookie,Defense Evasion|Lateral Movement,no
 T1550.001,Application Access Token,Defense Evasion|Lateral Movement,APT28
 T1550.003,Pass the Ticket,Defense Evasion|Lateral Movement,APT32|BRONZE BUTLER|APT29
-T1550.002,Pass the Hash,Defense Evasion|Lateral Movement,Chimera|Kimsuky|GALLIUM|APT32|Night Dragon|APT28|APT1
-T1550,Use Alternate Authentication Material,Defense Evasion|Lateral Movement,APT29|UNC2452
+T1550.002,Pass the Hash,Defense Evasion|Lateral Movement,Soft Cell|APT32|Night Dragon|APT28|APT1
+T1550,Use Alternate Authentication Material,Defense Evasion|Lateral Movement,no
 T1548.004,Elevated Execution with Prompt,Privilege Escalation|Defense Evasion,no
 T1548.003,Sudo and Sudo Caching,Privilege Escalation|Defense Evasion,no
-T1548.002,Bypass User Account Control,Privilege Escalation|Defense Evasion,Evilnum|APT37|MuddyWater|Cobalt Group|Honeybee|Threat Group-3390|BRONZE BUTLER|Patchwork|APT29
+T1548.002,Bypass User Access Control,Privilege Escalation|Defense Evasion,APT37|MuddyWater|Honeybee|Cobalt Group|Threat Group-3390|BRONZE BUTLER|Patchwork|APT29
 T1548.001,Setuid and Setgid,Privilege Escalation|Defense Evasion,no
 T1548,Abuse Elevation Control Mechanism,Privilege Escalation|Defense Evasion,no
 T1136.003,Cloud Account,Persistence,no
 T1070.002,Clear Linux or Mac System Logs,Defense Evasion,Rocke
-T1070.001,Clear Windows Event Logs,Defense Evasion,Chimera|Operation Wocao|APT41|APT38|APT32|Dragonfly 2.0|FIN8|FIN5|APT28
-T1136.002,Domain Account,Persistence,HAFNIUM|GALLIUM
-T1136.001,Local Account,Persistence,Fox Kitten|APT39|APT41|Dragonfly 2.0|Leafminer|APT3
+T1070.001,Clear Windows Event Logs,Defense Evasion,APT41|APT38|Dragonfly 2.0|APT32|FIN8|FIN5|APT28
+T1136.002,Domain Account,Persistence,Soft Cell
+T1136.001,Local Account,Persistence,APT39|APT41|Dragonfly 2.0|Leafminer|APT3
 T1547.011,Plist Modification,Persistence|Privilege Escalation,no
 T1547.010,Port Monitors,Persistence|Privilege Escalation,no
 T1547.009,Shortcut Modification,Persistence|Privilege Escalation,APT39|Darkhotel|APT29|Gorgon Group|Dragonfly 2.0|Leviathan|Lazarus Group
 T1547.008,LSASS Driver,Persistence|Privilege Escalation,no
 T1547.007,Re-opened Applications,Persistence|Privilege Escalation,no
 T1547.006,Kernel Modules and Extensions,Persistence|Privilege Escalation,no
-T1547.005,Security Support Provider,Persistence|Privilege Escalation,Lazarus Group
-T1547.004,Winlogon Helper DLL,Persistence|Privilege Escalation,Wizard Spider|Tropic Trooper|Turla
+T1547.005,Security Support Provider,Persistence|Privilege Escalation,no
+T1547.004,Winlogon Helper DLL,Persistence|Privilege Escalation,Tropic Trooper|Turla
 T1547.003,Time Providers,Persistence|Privilege Escalation,no
 T1546.014,Emond,Privilege Escalation|Persistence,no
 T1546.013,PowerShell Profile,Privilege Escalation|Persistence,Turla
@@ -359,38 +236,38 @@ T1546.012,Image File Execution Options Injection,Privilege Escalation|Persistenc
 T1218.008,Odbcconf,Defense Evasion,Cobalt Group
 T1546.011,Application Shimming,Privilege Escalation|Persistence,FIN7
 T1547.002,Authentication Package,Persistence|Privilege Escalation,no
-T1546.010,AppInit DLLs,Privilege Escalation|Persistence,APT39
+T1546.010,AppInit DLLs,Privilege Escalation|Persistence,no
 T1546.009,AppCert DLLs,Privilege Escalation|Persistence,Honeybee
-T1218.007,Msiexec,Defense Evasion,ZIRCONIUM|Molerats|Machete|TA505|Rancor
-T1546.008,Accessibility Features,Privilege Escalation|Persistence,Fox Kitten|APT41|APT3|APT29|Deep Panda|Axiom
+T1218.007,Msiexec,Defense Evasion,TA505|Rancor
+T1546.008,Accessibility Features,Privilege Escalation|Persistence,APT41|APT3|APT29|Deep Panda|Axiom
 T1546.007,Netsh Helper DLL,Privilege Escalation|Persistence,no
 T1546.006,LC_LOAD_DYLIB Addition,Privilege Escalation|Persistence,no
 T1546.005,Trap,Privilege Escalation|Persistence,no
-T1546.004,Unix Shell Configuration Modification,Privilege Escalation|Persistence,no
-T1546.003,Windows Management Instrumentation Event Subscription,Privilege Escalation|Persistence,Mustang Panda|UNC2452|APT33|Blue Mockingbird|Turla|Leviathan|APT29
+T1546.004,.bash_profile and .bashrc,Privilege Escalation|Persistence,no
+T1546.003,Windows Management Instrumentation Event Subscription,Privilege Escalation|Persistence,APT33|Blue Mockingbird|Turla|Leviathan|APT29
 T1546.002,Screensaver,Privilege Escalation|Persistence,no
 T1546.001,Change Default File Association,Privilege Escalation|Persistence,Kimsuky
-T1547.001,Registry Run Keys / Startup Folder,Persistence|Privilege Escalation,Windshift|Mustang Panda|ZIRCONIUM|Higaisa|Sidewinder|APT28|Wizard Spider|PROMETHIUM|Rocke|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Silence|RTM|Inception|APT41|Kimsuky|APT33|APT39|APT32|APT18|Dark Caracal|Threat Group-3390|Turla|Honeybee|APT19|Cobalt Group|Ke3chang|Dragonfly 2.0|Gorgon Group|Leviathan|APT37|MuddyWater|BRONZE BUTLER|APT3|Magic Hound|FIN10|FIN7|Patchwork|FIN6|Lazarus Group|Putter Panda|APT29|Darkhotel
+T1547.001,Registry Run Keys / Startup Folder,Persistence|Privilege Escalation,Rocke|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Silence|RTM|Inception|APT41|Machete|Kimsuky|APT33|APT39|APT32|APT18|Turla|Dark Caracal|Cobalt Group|Honeybee|Threat Group-3390|Dragonfly 2.0|Gorgon Group|Ke3chang|APT19|Leviathan|MuddyWater|APT37|BRONZE BUTLER|Magic Hound|APT3|FIN10|FIN7|Patchwork|FIN6|Lazarus Group|Putter Panda|APT29|Darkhotel
 T1218.002,Control Panel,Defense Evasion,no
-T1218.010,Regsvr32,Defense Evasion,TA551|Blue Mockingbird|Inception|WIRTE|Cobalt Group|APT19|Leviathan|APT32|Deep Panda
+T1218.010,Regsvr32,Defense Evasion,Blue Mockingbird|Inception|WIRTE|Cobalt Group|APT19|Leviathan|APT32|Deep Panda
 T1218.009,Regsvcs/Regasm,Defense Evasion,no
-T1218.005,Mshta,Defense Evasion,Mustang Panda|TA551|Sidewinder|Lazarus Group|Inception|Kimsuky|APT32|MuddyWater|FIN7
-T1218.004,InstallUtil,Defense Evasion,Mustang Panda|menuPass
-T1218.001,Compiled HTML File,Defense Evasion,APT41|Silence|Lazarus Group|OilRig|Dark Caracal
+T1218.005,Mshta,Defense Evasion,Inception|Kimsuky|APT32|MuddyWater|FIN7
+T1218.004,InstallUtil,Defense Evasion,no
+T1218.001,Compiled HTML File,Defense Evasion,APT41|Silence|Lazarus Group|Dark Caracal|OilRig
 T1218.003,CMSTP,Defense Evasion,Cobalt Group|MuddyWater
-T1218.011,Rundll32,Defense Evasion,HAFNIUM|TA551|UNC2452|APT41|Gamaredon Group|APT32|Sandworm Team|Blue Mockingbird|TA505|MuddyWater|APT29|APT19|CopyKittens|APT3|Carbanak|APT28
+T1218.011,Rundll32,Defense Evasion,APT32|Sandworm Team|Blue Mockingbird|TA505|MuddyWater|APT29|APT19|CopyKittens|APT3|Carbanak|APT28
 T1547,Boot or Logon Autostart Execution,Persistence|Privilege Escalation,no
 T1546,Event Triggered Execution,Privilege Escalation|Persistence,no
 T1098.003,Add Office 365 Global Administrator Role,Persistence,no
-T1098.002,Exchange Email Delegate Permissions,Persistence,APT29|UNC2452|Magic Hound
-T1098.001,Additional Cloud Credentials,Persistence,APT29|UNC2452
+T1098.002,Exchange Email Delegate Permissions,Persistence,Magic Hound
+T1098.001,Additional Azure Service Principal Credentials,Persistence,no
 T1543.004,Launch Daemon,Persistence|Privilege Escalation,no
-T1543.003,Windows Service,Persistence|Privilege Escalation,PROMETHIUM|Blue Mockingbird|DarkVishnya|Wizard Spider|APT32|APT41|Kimsuky|Tropic Trooper|Cobalt Group|Ke3chang|FIN7|APT19|Threat Group-3390|Honeybee|APT3|Lazarus Group|Carbanak
+T1543.003,Windows Service,Persistence|Privilege Escalation,Blue Mockingbird|DarkVishnya|Wizard Spider|APT32|APT41|Kimsuky|Tropic Trooper|Cobalt Group|Ke3chang|Honeybee|FIN7|Threat Group-3390|APT19|APT3|Lazarus Group|Carbanak
 T1543.002,Systemd Service,Persistence|Privilege Escalation,Rocke
 T1543.001,Launch Agent,Persistence|Privilege Escalation,no
 T1037.005,Startup Items,Persistence|Privilege Escalation,no
-T1037.004,RC Scripts,Persistence|Privilege Escalation,no
-T1055.012,Process Hollowing,Defense Evasion|Privilege Escalation,Gorgon Group|Threat Group-3390|menuPass|Patchwork
+T1037.004,Rc.common,Persistence|Privilege Escalation,no
+T1055.012,Process Hollowing,Defense Evasion|Privilege Escalation,Threat Group-3390|menuPass|Gorgon Group|Patchwork
 T1055.013,Process Doppelgänging,Defense Evasion|Privilege Escalation,Leafminer
 T1055.011,Extra Window Memory Injection,Defense Evasion|Privilege Escalation,no
 T1055.014,VDSO Hijacking,Defense Evasion|Privilege Escalation,no
@@ -400,7 +277,7 @@ T1055.005,Thread Local Storage,Defense Evasion|Privilege Escalation,no
 T1055.004,Asynchronous Procedure Call,Defense Evasion|Privilege Escalation,no
 T1055.003,Thread Execution Hijacking,Defense Evasion|Privilege Escalation,no
 T1055.002,Portable Executable Injection,Defense Evasion|Privilege Escalation,Rocke|Gorgon Group
-T1055.001,Dynamic-link Library Injection,Defense Evasion|Privilege Escalation,Wizard Spider|TA505|Turla|Tropic Trooper|Lazarus Group|Putter Panda
+T1055.001,Dynamic-link Library Injection,Defense Evasion|Privilege Escalation,TA505|Turla|Tropic Trooper|Lazarus Group|Putter Panda
 T1037.003,Network Logon Script,Persistence|Privilege Escalation,no
 T1543,Create or Modify System Process,Persistence|Privilege Escalation,no
 T1037.002,Logon Script (Mac),Persistence|Privilege Escalation,no
@@ -408,13 +285,13 @@ T1037.001,Logon Script (Windows),Persistence|Privilege Escalation,Cobalt Group|A
 T1542.003,Bootkit,Persistence|Defense Evasion,APT41|Lazarus Group|APT28
 T1542.002,Component Firmware,Persistence|Defense Evasion,Equation
 T1542.001,System Firmware,Persistence|Defense Evasion,no
-T1505.003,Web Shell,Persistence,Sandworm Team|HAFNIUM|Volatile Cedar|Fox Kitten|Operation Wocao|Kimsuky|Tropic Trooper|GALLIUM|Threat Group-3390|TEMP.Veles|Leviathan|APT39|Dragonfly 2.0|APT32|OilRig|Deep Panda
+T1505.003,Web Shell,Persistence,Tropic Trooper|Soft Cell|Threat Group-3390|TEMP.Veles|Leviathan|APT39|Dragonfly 2.0|APT32|OilRig|Deep Panda
 T1505.002,Transport Agent,Persistence,no
 T1505.001,SQL Stored Procedures,Persistence,no
 T1053.003,Cron,Execution|Persistence|Privilege Escalation,Rocke
 T1053.004,Launchd,Execution|Persistence|Privilege Escalation,no
 T1053.001,At (Linux),Execution|Persistence|Privilege Escalation,no
-T1053.005,Scheduled Task,Execution|Persistence|Privilege Escalation,Mustang Panda|Higaisa|UNC2452|Fox Kitten|Molerats|Machete|Operation Wocao|Chimera|Gamaredon Group|Blue Mockingbird|MuddyWater|Wizard Spider|Frankenstein|APT-C-36|BRONZE BUTLER|APT41|GALLIUM|Silence|TEMP.Veles|APT33|APT39|Dragonfly 2.0|Rancor|Cobalt Group|OilRig|Patchwork|FIN8|FIN7|menuPass|FIN10|APT32|Stealth Falcon|FIN6|APT3|APT29
+T1053.005,Scheduled Task,Execution|Persistence|Privilege Escalation,Gamaredon Group|Blue Mockingbird|MuddyWater|Wizard Spider|Frankenstein|APT-C-36|BRONZE BUTLER|APT41|Machete|Soft Cell|Silence|TEMP.Veles|APT33|APT39|Dragonfly 2.0|Patchwork|OilRig|Rancor|Cobalt Group|FIN8|menuPass|FIN10|APT32|FIN7|Stealth Falcon|FIN6|APT3|APT29
 T1053.002,At (Windows),Execution|Persistence|Privilege Escalation,BRONZE BUTLER|Threat Group-3390|APT18
 T1542,Pre-OS Boot,Defense Evasion|Persistence,no
 T1137.001,Office Template Macros,Persistence,MuddyWater
@@ -424,141 +301,140 @@ T1137.005,Outlook Rules,Persistence,no
 T1137.006,Add-ins,Persistence,Naikon
 T1137.002,Office Test,Persistence,APT28
 T1531,Account Access Removal,Impact,no
-T1539,Steal Web Session Cookie,Credential Access,Evilnum
+T1539,Steal Web Session Cookie,Credential Access,no
 T1529,System Shutdown/Reboot,Impact,Lazarus Group|APT38|APT37
-T1518,Software Discovery,Discovery,Mustang Panda|Windshift|MuddyWater|Windigo|Sidewinder|Operation Wocao|BRONZE BUTLER|Tropic Trooper|Inception
-T1547.013,XDG Autostart Entries,Persistence|Privilege Escalation,no
+T1518,Software Discovery,Discovery,BRONZE BUTLER|Tropic Trooper|Inception
 T1534,Internal Spearphishing,Lateral Movement,Gamaredon Group
 T1528,Steal Application Access Token,Credential Access,APT28
 T1535,Unused/Unsupported Cloud Regions,Defense Evasion,no
-T1525,Implant Internal Image,Persistence,no
+T1525,Implant Container Image,Persistence,no
 T1538,Cloud Service Dashboard,Discovery,no
-T1530,Data from Cloud Storage Object,Collection,Fox Kitten
+T1530,Data from Cloud Storage Object,Collection,no
 T1578,Modify Cloud Compute Infrastructure,Defense Evasion,no
 T1537,Transfer Data to Cloud Account,Exfiltration,no
 T1526,Cloud Service Discovery,Discovery,no
 T1505,Server Software Component,Persistence,no
-T1499,Endpoint Denial of Service,Impact,Sandworm Team
-T1497,Virtualization/Sandbox Evasion,Defense Evasion|Discovery,Darkhotel
-T1498,Network Denial of Service,Impact,APT28
+T1499,Endpoint Denial of Service,Impact,no
+T1497,Virtualization/Sandbox Evasion,Defense Evasion|Discovery,no
+T1498,Network Denial of Service,Impact,no
 T1496,Resource Hijacking,Impact,Blue Mockingbird|Rocke|APT41|Lazarus Group
 T1495,Firmware Corruption,Impact,no
 T1491,Defacement,Impact,no
 T1490,Inhibit System Recovery,Impact,no
-T1489,Service Stop,Impact,Wizard Spider|Lazarus Group
-T1486,Data Encrypted for Impact,Impact,Indrik Spider|APT41|TA505|APT38
+T1489,Service Stop,Impact,Lazarus Group
+T1486,Data Encrypted for Impact,Impact,APT41|TA505|APT38
 T1485,Data Destruction,Impact,Sandworm Team|Lazarus Group|APT38
-T1484,Domain Policy Modification,Defense Evasion|Privilege Escalation,no
-T1482,Domain Trust Discovery,Discovery,APT29|Chimera|UNC2452
+T1484,Group Policy Modification,Defense Evasion|Privilege Escalation,no
+T1482,Domain Trust Discovery,Discovery,Wizard Spider
 T1480,Execution Guardrails,Defense Evasion,no
-T1221,Template Injection,Defense Evasion,Gamaredon Group|Frankenstein|Inception|APT28|Tropic Trooper|Dragonfly 2.0|DarkHydrus
-T1220,XSL Script Processing,Defense Evasion,Higaisa|Cobalt Group
 T1222,File and Directory Permissions Modification,Defense Evasion,no
-T1189,Drive-by Compromise,Initial Access,Machete|Windigo|Dragonfly|PROMETHIUM|Turla|Windshift|RTM|Darkhotel|APT38|Lazarus Group|BRONZE BUTLER|Threat Group-3390|Dragonfly 2.0|APT32|Leafminer|APT19|Dark Caracal|Elderwood|Patchwork|PLATINUM|APT37
-T1207,Rogue Domain Controller,Defense Evasion,no
-T1199,Trusted Relationship,Initial Access,Sandworm Team|GOLD SOUTHFIELD|APT28|menuPass
-T1197,BITS Jobs,Defense Evasion|Persistence,APT39|Patchwork|APT41|Leviathan
-T1217,Browser Bookmark Discovery,Discovery,Chimera|Fox Kitten
-T1213,Data from Information Repositories,Collection,Fox Kitten|FIN6|Turla
+T1221,Template Injection,Defense Evasion,Gamaredon Group|Frankenstein|Inception|APT28|Tropic Trooper|Dragonfly 2.0|DarkHydrus
+T1220,XSL Script Processing,Defense Evasion,Cobalt Group
+T1197,BITS Jobs,Defense Evasion|Persistence,Patchwork|APT41|Leviathan
+T1217,Browser Bookmark Discovery,Discovery,no
+T1213,Data from Information Repositories,Collection,Turla
+T1189,Drive-by Compromise,Initial Access,Turla|Windshift|RTM|Darkhotel|APT38|Dragonfly 2.0|BRONZE BUTLER|Leafminer|Dark Caracal|APT19|APT32|Lazarus Group|Threat Group-3390|Elderwood|APT37|Patchwork|PLATINUM
+T1203,Exploitation for Client Execution,Execution,Sandworm Team|MuddyWater|Frankenstein|Inception|BlackTech|APT41|admin@338|Threat Group-3390|APT12|The White Company|APT33|APT32|APT28|Tropic Trooper|Lazarus Group|BRONZE BUTLER|Cobalt Group|APT37|Patchwork|Leviathan|Elderwood|TA459|APT29
 T1212,Exploitation for Credential Access,Credential Access,no
 T1211,Exploitation for Defense Evasion,Defense Evasion,APT28
-T1200,Hardware Additions,Initial Access,DarkVishnya
+T1190,Exploit Public-Facing Application,Initial Access,Blue Mockingbird|Rocke|APT39|BlackTech|APT41|Soft Cell|Night Dragon|Axiom
+T1210,Exploitation of Remote Services,Lateral Movement,Threat Group-3390|APT28
 T1202,Indirect Command Execution,Defense Evasion,no
-T1201,Password Policy Discovery,Discovery,Chimera|Turla|OilRig
-T1190,Exploit Public-Facing Application,Initial Access,Volatile Cedar|UNC2452|Fox Kitten|Operation Wocao|APT28|APT29|GOLD SOUTHFIELD|Blue Mockingbird|Rocke|APT39|BlackTech|APT41|GALLIUM|Night Dragon|Axiom
-T1210,Exploitation of Remote Services,Lateral Movement,Fox Kitten|menuPass|Wizard Spider|Threat Group-3390|APT28
-T1219,Remote Access Software,Command And Control,Mustang Panda|MuddyWater|Evilnum|GOLD SOUTHFIELD|Sandworm Team|DarkVishnya|RTM|Kimsuky|Night Dragon|Thrip|Cobalt Group|Carbanak
-T1195,Supply Chain Compromise,Initial Access,no
-T1204,User Execution,Execution,no
-T1203,Exploitation for Client Execution,Execution,Mustang Panda|Darkhotel|Higaisa|HAFNIUM|Sidewinder|Sandworm Team|MuddyWater|Frankenstein|Inception|BlackTech|APT41|admin@338|Threat Group-3390|APT12|The White Company|APT33|APT32|APT28|Tropic Trooper|BRONZE BUTLER|Cobalt Group|Lazarus Group|APT29|TA459|APT37|Leviathan|Patchwork|Elderwood
+T1200,Hardware Additions,Initial Access,DarkVishnya
+T1201,Password Policy Discovery,Discovery,Turla|OilRig
+T1219,Remote Access Software,Command And Control,Sandworm Team|DarkVishnya|RTM|Kimsuky|Night Dragon|Thrip|Cobalt Group|Carbanak
+T1207,Rogue Domain Controller,Defense Evasion,no
+T1199,Trusted Relationship,Initial Access,APT28|menuPass
 T1218,Signed Binary Proxy Execution,Defense Evasion,no
-T1205,Traffic Signaling,Defense Evasion|Persistence|Command And Control,no
+T1204,User Execution,Execution,no
 T1216,Signed Script Proxy Execution,Defense Evasion,no
+T1195,Supply Chain Compromise,Initial Access,Elderwood
+T1205,Traffic Signaling,Defense Evasion|Persistence|Command And Control,no
 T1176,Browser Extensions,Persistence,Kimsuky|Stolen Pencil
 T1175,Component Object Model and Distributed COM,Lateral Movement|Execution,no
-T1187,Forced Authentication,Credential Access,Dragonfly 2.0|DarkHydrus
+T1187,Forced Authentication,Credential Access,DarkHydrus|Dragonfly 2.0
 T1185,Man in the Browser,Collection,no
-T1134,Access Token Manipulation,Defense Evasion|Privilege Escalation,FIN6|Blue Mockingbird
+T1134,Access Token Manipulation,Defense Evasion|Privilege Escalation,Blue Mockingbird
 T1136,Create Account,Persistence,no
+T1140,Deobfuscate/Decode Files or Information,Defense Evasion,Rocke|Sandworm Team|Gamaredon Group|Molerats|Frankenstein|Turla|WIRTE|Darkhotel|Tropic Trooper|menuPass|Honeybee|Threat Group-3390|APT19|Gorgon Group|Leviathan|MuddyWater|APT28|OilRig|BRONZE BUTLER
 T1149,LC_MAIN Hijacking,Defense Evasion,no
+T1135,Network Share Discovery,Discovery,APT32|APT39|DarkVishnya|APT41|Tropic Trooper|APT1|Dragonfly 2.0|Sowbug
 T1137,Office Application Startup,Persistence,Gamaredon Group|APT32
-T1140,Deobfuscate/Decode Files or Information,Defense Evasion,APT39|APT29|ZIRCONIUM|Higaisa|UNC2452|Rocke|Sandworm Team|Gamaredon Group|Molerats|Frankenstein|Turla|WIRTE|Darkhotel|Tropic Trooper|Threat Group-3390|menuPass|Gorgon Group|Honeybee|APT19|Leviathan|MuddyWater|APT28|OilRig|BRONZE BUTLER
-T1135,Network Share Discovery,Discovery,Chimera|Operation Wocao|Wizard Spider|APT32|APT39|DarkVishnya|APT41|Tropic Trooper|APT1|Dragonfly 2.0|Sowbug
 T1153,Source,Execution,no
-T1133,External Remote Services,Persistence|Initial Access,APT29|UNC2452|Operation Wocao|Wizard Spider|Kimsuky|GOLD SOUTHFIELD|Chimera|Sandworm Team|APT41|GALLIUM|TEMP.Veles|Night Dragon|OilRig|Dragonfly 2.0|Ke3chang|FIN5|Threat Group-3390|APT18
+T1133,External Remote Services,Persistence|Initial Access,Sandworm Team|APT41|Soft Cell|TEMP.Veles|Night Dragon|OilRig|Dragonfly 2.0|Ke3chang|FIN5|Threat Group-3390|APT18
 T1132,Data Encoding,Command And Control,no
 T1129,Shared Modules,Execution,no
 T1127,Trusted Developer Utilities Proxy Execution,Defense Evasion,no
 T1125,Video Capture,Collection,Silence|FIN7
-T1124,System Time Discovery,Discovery,Darkhotel|ZIRCONIUM|Higaisa|Sidewinder|Chimera|Operation Wocao|The White Company|Lazarus Group|BRONZE BUTLER|Turla
+T1124,System Time Discovery,Discovery,The White Company|Lazarus Group|BRONZE BUTLER|Turla
 T1123,Audio Capture,Collection,APT37
-T1120,Peripheral Device Discovery,Discovery,Operation Wocao|Turla|APT37|Gamaredon Group|Equation|APT28
-T1119,Automated Collection,Collection,Mustang Panda|Sidewinder|Chimera|menuPass|Operation Wocao|Gamaredon Group|Tropic Trooper|Frankenstein|APT1|APT28|Patchwork|OilRig|FIN5|Threat Group-3390|FIN6
-T1115,Clipboard Data,Collection,Operation Wocao|APT39|APT38
-T1114,Email Collection,Collection,Silent Librarian
-T1113,Screen Capture,Collection,GOLD SOUTHFIELD|Gamaredon Group|APT39|Silence|MuddyWater|OilRig|Dragonfly 2.0|Dark Caracal|FIN7|BRONZE BUTLER|Magic Hound|Group5|APT28
-T1112,Modify Registry,Defense Evasion,Operation Wocao|Kimsuky|Lazarus Group|Gamaredon Group|Blue Mockingbird|Wizard Spider|Silence|APT41|Turla|APT32|APT38|Patchwork|Gorgon Group|Dragonfly 2.0|APT19|Threat Group-3390|Honeybee|FIN8
-T1111,Two-Factor Authentication Interception,Credential Access,Chimera|Operation Wocao
-T1110,Brute Force,Credential Access,APT28|Fox Kitten|DarkVishnya|APT39|OilRig|FIN5|Turla
+T1120,Peripheral Device Discovery,Discovery,Turla|APT37|Gamaredon Group|Equation|APT28
+T1119,Automated Collection,Collection,Tropic Trooper|Frankenstein|APT1|APT28|Patchwork|OilRig|FIN5|Threat Group-3390|FIN6
+T1115,Clipboard Data,Collection,APT39|APT38
+T1114,Email Collection,Collection,no
+T1113,Screen Capture,Collection,Gamaredon Group|APT39|Silence|MuddyWater|Dragonfly 2.0|OilRig|Dark Caracal|FIN7|BRONZE BUTLER|Magic Hound|Group5|APT28
+T1112,Modify Registry,Defense Evasion,Gamaredon Group|Blue Mockingbird|Wizard Spider|Silence|APT41|Turla|APT32|APT38|Dragonfly 2.0|APT19|Threat Group-3390|Honeybee|Patchwork|Gorgon Group|FIN8
+T1111,Two-Factor Authentication Interception,Credential Access,no
+T1110,Brute Force,Credential Access,DarkVishnya|APT39|OilRig|FIN5|Turla
 T1108,Redundant Access,Defense Evasion|Persistence,no
-T1106,Native API,Execution,Higaisa|menuPass|Operation Wocao|Chimera|Gamaredon Group|Tropic Trooper|Sharpshooter|Turla|Silence|APT37|Gorgon Group
-T1105,Ingress Tool Transfer,Command And Control,HAFNIUM|APT29|Ajax Security Team|Mustang Panda|Windshift|Darkhotel|ZIRCONIUM|TA551|Volatile Cedar|Indrik Spider|Evilnum|Sidewinder|UNC2452|Fox Kitten|Kimsuky|Operation Wocao|Chimera|Sandworm Team|Whitefly|Rocke|APT39|Tropic Trooper|Sharpshooter|Molerats|Frankenstein|Silence|APT-C-36|APT41|GALLIUM|TA505|WIRTE|APT33|MuddyWater|APT18|APT38|Turla|OilRig|Rancor|Cobalt Group|Gorgon Group|Dragonfly 2.0|APT37|Elderwood|Leviathan|FIN8|PLATINUM|Magic Hound|BRONZE BUTLER|APT3|APT32|menuPass|FIN7|Gamaredon Group|Patchwork|Lazarus Group|Threat Group-3390|APT28
+T1106,Native API,Execution,Gamaredon Group|Tropic Trooper|Sharpshooter|Turla|Silence|Gorgon Group|APT37
+T1105,Ingress Tool Transfer,Command And Control,Sandworm Team|Whitefly|Rocke|APT39|Tropic Trooper|Sharpshooter|Molerats|Frankenstein|Silence|APT-C-36|APT41|Soft Cell|TA505|WIRTE|APT33|MuddyWater|APT18|APT38|Rancor|Cobalt Group|Turla|Gorgon Group|OilRig|Dragonfly 2.0|APT37|FIN8|PLATINUM|Leviathan|Elderwood|Magic Hound|APT3|APT32|BRONZE BUTLER|menuPass|FIN7|Gamaredon Group|Patchwork|Lazarus Group|Threat Group-3390|APT28
 T1104,Multi-Stage Channels,Command And Control,APT41|MuddyWater|APT3
-T1102,Web Service,Command And Control,Fox Kitten|Turla|APT32|Gamaredon Group|Rocke|Inception|FIN6
+T1102,Web Service,Command And Control,Gamaredon Group|Rocke|Inception|FIN6
 T1098,Account Manipulation,Persistence,APT3|Dragonfly 2.0|Lazarus Group
-T1095,Non-Application Layer Protocol,Command And Control,HAFNIUM|Operation Wocao|FIN6|APT29|PLATINUM|APT3
+T1095,Non-Application Layer Protocol,Command And Control,APT29|PLATINUM|APT3
 T1092,Communication Through Removable Media,Command And Control,APT28
-T1091,Replication Through Removable Media,Lateral Movement|Initial Access,Mustang Panda|Tropic Trooper|Darkhotel|APT28
-T1090,Proxy,Command And Control,Windigo|Fox Kitten|Operation Wocao|Sandworm Team|Blue Mockingbird|APT41|Turla
-T1087,Account Discovery,Discovery,APT29|UNC2452
-T1083,File and Directory Discovery,Discovery,APT29|Mustang Panda|Darkhotel|Windigo|Sidewinder|Chimera|UNC2452|Fox Kitten|menuPass|APT39|Sandworm Team|Operation Wocao|Gamaredon Group|Tropic Trooper|Inception|APT41|Kimsuky|APT32|MuddyWater|APT18|Leafminer|Honeybee|Dragonfly 2.0|Dark Caracal|Sowbug|APT3|Magic Hound|BRONZE BUTLER|APT28|Patchwork|Lazarus Group|Dust Storm|admin@338|Turla|Ke3chang
-T1082,System Information Discovery,Discovery,APT29|Mustang Panda|Windshift|ZIRCONIUM|Higaisa|Windigo|Sidewinder|UNC2452|Chimera|Operation Wocao|Wizard Spider|Rocke|Sandworm Team|Blue Mockingbird|Tropic Trooper|Frankenstein|Inception|Kimsuky|Darkhotel|MuddyWater|APT18|APT32|APT37|Honeybee|APT19|Magic Hound|Sowbug|OilRig|APT3|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|admin@338|Turla|Ke3chang
-T1080,Taint Shared Content,Lateral Movement,Gamaredon Group|BRONZE BUTLER|Darkhotel
-T1078,Valid Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,APT29|Silent Librarian|UNC2452|Fox Kitten|Operation Wocao|Chimera|Sandworm Team|Wizard Spider|Silence|APT41|GALLIUM|TEMP.Veles|APT39|FIN4|Night Dragon|Dragonfly 2.0|APT33|Leviathan|FIN8|OilRig|FIN5|menuPass|APT28|FIN10|Suckfly|FIN6|Threat Group-3390|APT18|PittyTiger|Carbanak
+T1091,Replication Through Removable Media,Lateral Movement|Initial Access,Tropic Trooper|Darkhotel|APT28
+T1090,Proxy,Command And Control,Sandworm Team|Blue Mockingbird|Wizard Spider|APT41|Turla
+T1087,Account Discovery,Discovery,no
+T1083,File and Directory Discovery,Discovery,Gamaredon Group|Tropic Trooper|Inception|APT41|Kimsuky|APT32|MuddyWater|APT18|Leafminer|Honeybee|Dark Caracal|Dragonfly 2.0|Magic Hound|Sowbug|BRONZE BUTLER|APT3|APT28|Patchwork|Lazarus Group|Dust Storm|admin@338|Turla|Ke3chang
+T1082,System Information Discovery,Discovery,Rocke|Sandworm Team|Blue Mockingbird|Tropic Trooper|Frankenstein|Inception|Kimsuky|Darkhotel|MuddyWater|APT18|Honeybee|APT19|APT37|APT32|Magic Hound|OilRig|APT3|Sowbug|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|admin@338|Turla|Ke3chang
+T1080,Taint Shared Content,Lateral Movement,BRONZE BUTLER|Darkhotel
+T1078,Valid Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,Sandworm Team|Wizard Spider|Silence|APT41|Soft Cell|TEMP.Veles|APT39|FIN4|Night Dragon|Dragonfly 2.0|FIN8|Leviathan|APT33|OilRig|FIN5|menuPass|APT28|FIN10|Suckfly|FIN6|Threat Group-3390|APT18|PittyTiger|Carbanak
 T1074,Data Staged,Collection,Wizard Spider
 T1072,Software Deployment Tools,Execution|Lateral Movement,Silence|APT32|Threat Group-1314
 T1071,Application Layer Protocol,Command And Control,Rocke|Magic Hound|Dragonfly 2.0
-T1070,Indicator Removal on Host,Defense Evasion,APT29|UNC2452
-T1069,Permission Groups Discovery,Discovery,APT29|UNC2452|TA505|APT3
-T1068,Exploitation for Privilege Escalation,Privilege Escalation,ZIRCONIUM|Turla|Whitefly|APT33|Cobalt Group|PLATINUM|FIN8|APT32|Threat Group-3390|FIN6|APT28
+T1070,Indicator Removal on Host,Defense Evasion,no
+T1069,Permission Groups Discovery,Discovery,TA505|APT3
+T1068,Exploitation for Privilege Escalation,Privilege Escalation,Whitefly|APT33|Cobalt Group|PLATINUM|FIN8|APT32|Threat Group-3390|FIN6|APT28
 T1064,Scripting,Defense Evasion|Execution,no
 T1062,Hypervisor,Persistence,no
 T1061,Graphical User Interface,Execution,no
-T1059,Command and Scripting Interpreter,Execution,Windigo|Fox Kitten|APT32|Whitefly|APT39|Dragonfly 2.0|APT19|FIN7|OilRig|FIN5|Stealth Falcon|FIN6|Ke3chang
-T1057,Process Discovery,Discovery,APT29|Mustang Panda|Windshift|Higaisa|Sidewinder|Chimera|UNC2452|Operation Wocao|Rocke|Frankenstein|Inception|Darkhotel|MuddyWater|APT1|APT38|Tropic Trooper|APT37|Honeybee|OilRig|APT3|Magic Hound|APT28|Winnti Group|Stealth Falcon|Poseidon Group|Lazarus Group|Molerats|Turla|Deep Panda|Ke3chang
-T1056,Input Capture,Collection|Credential Access,APT39
-T1055,Process Injection,Defense Evasion|Privilege Escalation,Operation Wocao|APT32|Sharpshooter|Silence|APT41|Kimsuky|APT37|Cobalt Group|Turla|Honeybee|PLATINUM
+T1059,Command and Scripting Interpreter,Execution,APT32|Molerats|Whitefly|Dragonfly 2.0|APT19|FIN7|OilRig|FIN5|Stealth Falcon|FIN6|Ke3chang
+T1057,Process Discovery,Discovery,Rocke|Frankenstein|Inception|Darkhotel|MuddyWater|APT1|APT38|Tropic Trooper|APT37|Honeybee|OilRig|APT3|Magic Hound|APT28|Winnti Group|Stealth Falcon|Poseidon Group|Lazarus Group|Molerats|Turla|Deep Panda|Ke3chang
+T1056,Input Capture,Collection|Credential Access,no
+T1055,Process Injection,Defense Evasion|Privilege Escalation,APT32|Sharpshooter|Silence|APT41|Kimsuky|Turla|Cobalt Group|APT37|Honeybee|PLATINUM
 T1053,Scheduled Task/Job,Execution|Persistence|Privilege Escalation,no
 T1052,Exfiltration Over Physical Medium,Exfiltration,no
 T1051,Shared Webroot,Lateral Movement,no
-T1049,System Network Connections Discovery,Discovery,Mustang Panda|MuddyWater|Chimera|Sandworm Team|Operation Wocao|Tropic Trooper|APT41|APT38|GALLIUM|APT32|APT1|APT3|OilRig|menuPass|Threat Group-3390|Poseidon Group|admin@338|Turla|Ke3chang
+T1049,System Network Connections Discovery,Discovery,Tropic Trooper|APT41|APT38|Soft Cell|APT32|APT1|OilRig|APT3|menuPass|Threat Group-3390|Poseidon Group|admin@338|Turla|Ke3chang
 T1048,Exfiltration Over Alternative Protocol,Exfiltration,no
-T1047,Windows Management Instrumentation,Execution,Mustang Panda|Windshift|UNC2452|Operation Wocao|Chimera|Blue Mockingbird|Wizard Spider|Frankenstein|APT41|FIN6|GALLIUM|APT32|MuddyWater|Threat Group-3390|OilRig|FIN8|Leviathan|menuPass|Stealth Falcon|Lazarus Group|APT29|Deep Panda
-T1046,Network Service Scanning,Discovery,Chimera|Fox Kitten|Operation Wocao|Rocke|DarkVishnya|APT41|Tropic Trooper|APT39|APT32|Cobalt Group|OilRig|Leafminer|menuPass|Suckfly|FIN6|Threat Group-3390
-T1043,Commonly Used Port,Command And Control,OilRig|APT28|TEMP.Veles|Night Dragon|APT29|APT18|APT19|FIN7|Dragonfly 2.0|FIN8|APT37|APT3|Magic Hound|Lazarus Group|Threat Group-3390
-T1041,Exfiltration Over C2 Channel,Exfiltration,ZIRCONIUM|Higaisa|Chimera|APT39|Operation Wocao|Sandworm Team|MuddyWater|Wizard Spider|Frankenstein|Kimsuky|GALLIUM|APT32|APT3|Gamaredon Group|Stealth Falcon|Lazarus Group|Ke3chang
-T1040,Network Sniffing,Credential Access|Discovery,Kimsuky|Sandworm Team|DarkVishnya|APT33|Stolen Pencil|APT28
-T1039,Data from Network Shared Drive,Collection,Chimera|Fox Kitten|Gamaredon Group|BRONZE BUTLER|Sowbug|menuPass
+T1047,Windows Management Instrumentation,Execution,Blue Mockingbird|Wizard Spider|Frankenstein|APT41|FIN6|Soft Cell|APT32|MuddyWater|OilRig|Threat Group-3390|FIN8|Leviathan|menuPass|Stealth Falcon|Lazarus Group|APT29|Deep Panda
+T1046,Network Service Scanning,Discovery,Rocke|DarkVishnya|APT41|Tropic Trooper|APT39|APT32|Leafminer|OilRig|Cobalt Group|menuPass|Suckfly|FIN6|Threat Group-3390
+T1043,Commonly Used Port,Command And Control,Machete|OilRig|APT28|TEMP.Veles|Night Dragon|APT29|APT18|APT19|Dragonfly 2.0|FIN7|FIN8|APT37|Magic Hound|APT3|Lazarus Group|Threat Group-3390
+T1041,Exfiltration Over C2 Channel,Exfiltration,Sandworm Team|MuddyWater|Wizard Spider|Frankenstein|Kimsuky|Soft Cell|APT32|APT3|Gamaredon Group|Stealth Falcon|Lazarus Group|Ke3chang
+T1040,Network Sniffing,Credential Access|Discovery,Sandworm Team|DarkVishnya|APT33|Stolen Pencil|APT28
+T1039,Data from Network Shared Drive,Collection,Sowbug|BRONZE BUTLER|menuPass
 T1037,Boot or Logon Initialization Scripts,Persistence|Privilege Escalation,Rocke
-T1036,Masquerading,Defense Evasion,APT29|Mustang Panda|ZIRCONIUM|TA551|UNC2452|Windshift|APT32|BRONZE BUTLER|menuPass|PLATINUM|Dragonfly 2.0
+T1036,Masquerading,Defense Evasion,Windshift|APT32|BRONZE BUTLER|menuPass|Dragonfly 2.0
 T1034,Path Interception,Persistence|Privilege Escalation,no
-T1033,System Owner/User Discovery,Discovery,Windshift|ZIRCONIUM|Sidewinder|Chimera|Sandworm Team|Operation Wocao|Wizard Spider|Frankenstein|APT41|GALLIUM|Tropic Trooper|APT39|MuddyWater|Dragonfly 2.0|APT37|APT19|APT32|OilRig|Magic Hound|FIN10|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|APT3
+T1033,System Owner/User Discovery,Discovery,Frankenstein|APT41|Soft Cell|Tropic Trooper|APT39|MuddyWater|APT32|APT37|APT19|Dragonfly 2.0|OilRig|Magic Hound|FIN10|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|APT3
 T1030,Data Transfer Size Limits,Exfiltration,Threat Group-3390
-T1029,Scheduled Transfer,Exfiltration,Higaisa
-T1027,Obfuscated Files or Information,Defense Evasion,APT39|Mustang Panda|Windshift|TA551|Higaisa|Sidewinder|UNC2452|Fox Kitten|GOLD SOUTHFIELD|Operation Wocao|Kimsuky|FIN6|Chimera|Gamaredon Group|Rocke|Sandworm Team|Blue Mockingbird|Whitefly|Molerats|Wizard Spider|Mofang|Frankenstein|Inception|APT-C-36|APT41|GALLIUM|Turla|TA505|Silence|APT33|Night Dragon|Darkhotel|Gallmaker|APT29|APT18|Tropic Trooper|Cobalt Group|Patchwork|APT37|Honeybee|Dark Caracal|Leafminer|menuPass|Threat Group-3390|APT19|BlackOasis|FIN8|FIN7|Elderwood|MuddyWater|Leviathan|Magic Hound|OilRig|APT3|APT32|Group5|Lazarus Group|Dust Storm|Putter Panda|APT28
+T1029,Scheduled Transfer,Exfiltration,no
+T1027,Obfuscated Files or Information,Defense Evasion,Gamaredon Group|Rocke|Sandworm Team|Blue Mockingbird|Whitefly|Molerats|Wizard Spider|Mofang|Frankenstein|Inception|APT-C-36|APT41|Machete|Soft Cell|Turla|TA505|Silence|APT33|Night Dragon|Darkhotel|Gallmaker|APT29|APT18|Tropic Trooper|Cobalt Group|Patchwork|Leafminer|APT37|Threat Group-3390|Honeybee|Dark Caracal|menuPass|APT19|BlackOasis|FIN8|Leviathan|Elderwood|MuddyWater|FIN7|Magic Hound|OilRig|APT3|APT32|Group5|Dust Storm|Lazarus Group|Putter Panda|APT28
 T1026,Multiband Communication,Command And Control,Lazarus Group
-T1025,Data from Removable Media,Collection,Turla|Gamaredon Group|APT28
+T1025,Data from Removable Media,Collection,Machete|Turla|Gamaredon Group|APT28
 T1021,Remote Services,Lateral Movement,no
-T1020,Automated Exfiltration,Exfiltration,Sidewinder|Gamaredon Group|Tropic Trooper|Frankenstein|Honeybee
-T1018,Remote System Discovery,Discovery,APT29|UNC2452|Chimera|Fox Kitten|Operation Wocao|Sandworm Team|Rocke|Wizard Spider|Silence|GALLIUM|APT39|APT32|Deep Panda|Dragonfly 2.0|Threat Group-3390|Leafminer|Ke3chang|FIN8|BRONZE BUTLER|FIN5|APT3|menuPass|FIN6|Turla
-T1016,System Network Configuration Discovery,Discovery,ZIRCONIUM|Mustang Panda|Higaisa|Sidewinder|Chimera|Operation Wocao|Wizard Spider|Sandworm Team|Tropic Trooper|Frankenstein|APT41|GALLIUM|APT32|Darkhotel|MuddyWater|APT1|APT19|Dragonfly 2.0|OilRig|Magic Hound|menuPass|Threat Group-3390|Stealth Falcon|Lazarus Group|APT3|Naikon|admin@338|Turla|Ke3chang
+T1020,Automated Exfiltration,Exfiltration,Tropic Trooper|Frankenstein|Honeybee
+T1018,Remote System Discovery,Discovery,Sandworm Team|Rocke|Wizard Spider|Silence|Soft Cell|APT39|APT32|Deep Panda|Threat Group-3390|Dragonfly 2.0|Leafminer|Ke3chang|FIN8|APT3|FIN5|BRONZE BUTLER|menuPass|FIN6|Turla
+T1016,System Network Configuration Discovery,Discovery,Sandworm Team|Tropic Trooper|Frankenstein|APT41|Soft Cell|APT32|Darkhotel|MuddyWater|APT1|APT19|Dragonfly 2.0|Magic Hound|OilRig|menuPass|Threat Group-3390|Stealth Falcon|Lazarus Group|APT3|Naikon|admin@338|Turla|Ke3chang
 T1014,Rootkit,Defense Evasion,Rocke|APT41|APT28|Winnti Group
-T1012,Query Registry,Discovery,ZIRCONIUM|Chimera|Fox Kitten|APT39|Operation Wocao|APT32|Threat Group-3390|Dragonfly 2.0|OilRig|Stealth Falcon|Lazarus Group|Turla
+T1012,Query Registry,Discovery,APT32|Dragonfly 2.0|Threat Group-3390|OilRig|Stealth Falcon|Lazarus Group|Turla
 T1011,Exfiltration Over Other Network Medium,Exfiltration,no
 T1010,Application Window Discovery,Discovery,Lazarus Group
-T1008,Fallback Channels,Command And Control,Carbanak|APT41|OilRig|Lazarus Group
-T1007,System Service Discovery,Discovery,Chimera|Operation Wocao|BRONZE BUTLER|APT1|OilRig|Poseidon Group|admin@338|Turla|Ke3chang
+T1008,Fallback Channels,Command And Control,APT41|OilRig|Lazarus Group
+T1007,System Service Discovery,Discovery,BRONZE BUTLER|APT1|OilRig|Poseidon Group|admin@338|Turla|Ke3chang
 T1006,Direct Volume Access,Defense Evasion,no
-T1005,Data from Local System,Collection,APT29|Windigo|UNC2452|Fox Kitten|Sandworm Team|Operation Wocao|FIN6|Gamaredon Group|APT39|Frankenstein|Inception|Kimsuky|GALLIUM|Turla|menuPass|Dragonfly 2.0|Dark Caracal|Honeybee|APT37|APT28|BRONZE BUTLER|APT3|Patchwork|Stealth Falcon|Lazarus Group|Dust Storm|Threat Group-3390|APT1|Ke3chang
+T1005,Data from Local System,Collection,Gamaredon Group|APT39|Frankenstein|Inception|Kimsuky|Soft Cell|Turla|menuPass|Dark Caracal|Dragonfly 2.0|Honeybee|APT37|APT28|APT3|BRONZE BUTLER|Patchwork|Stealth Falcon|Lazarus Group|Dust Storm|Threat Group-3390|APT1|Ke3chang
 T1003,OS Credential Dumping,Credential Access,APT39|Frankenstein|APT32|APT28|Leviathan|Sowbug|Suckfly|Poseidon Group|Axiom
-T1001,Data Obfuscation,Command And Control,Operation Wocao|Axiom
+T1001,Data Obfuscation,Command And Control,Axiom
@@ -5,7 +5,7 @@
    "id": {
      "group": null, 
      "name": "DA-ESS_AmazonWebServices_Content", 
-      "version": "3.20.0"
+      "version": "3.21.0"
    }, 
    "author": [
      {
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-04-29T21:11:03 UTC
+# On Date: 2021-05-13T21:47:01 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -34,7 +34,7 @@ version = 2
 reference = ["https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Appendix_NACLs.html", "https://aws.amazon.com/blogs/security/how-to-help-prepare-for-ddos-attacks-by-reducing-your-attack-surface/"]
 detection_searches = ["ESCU - AWS Network Access Control List Created with All Open Ports - Rule", "ESCU - AWS Network Access Control List Deleted - Rule"]
 mappings = {"cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.007"], "nist": ["DE.AE", "DE.DP"]}
-investigative_searches = ["ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task"]
+investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"]
 support_searches = []
 data_models = []
 providing_technologies = none
@@ -51,7 +51,7 @@ version = 1
 reference = ["https://aws.amazon.com/security-hub/features/"]
 detection_searches = ["ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule"]
 mappings = {"cis20": ["CIS 13"], "nist": ["DE.AE", "DE.DP"]}
-investigative_searches = ["ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Launch Details - Response Task"]
+investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task"]
 support_searches = []
 data_models = []
 providing_technologies = none
@@ -68,8 +68,8 @@ version = 1
 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
 detection_searches = ["ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule", "ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule"]
 mappings = {"cis20": ["CIS 1", "CIS 12", "CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1535"], "nist": ["DE.AE", "DE.DP", "ID.AM"]}
-investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"]
-support_searches = ["ESCU - Previously Seen Cloud Compute Creations By User - Initial", "ESCU - Baseline Of Cloud Instances Destroyed", "ESCU - Previously Seen Cloud Compute Images - Update", "ESCU - Previously Seen Cloud Regions - Initial", "ESCU - Baseline Of Cloud Instances Launched", "ESCU - Previously Seen Cloud Compute Instance Types - Update", "ESCU - Previously Seen Cloud Regions - Update", "ESCU - Previously Seen Cloud Compute Instance Types - Initial", "ESCU - Previously Seen Cloud Compute Images - Initial", "ESCU - Previously Seen Cloud Compute Creations By User - Update"]
+investigative_searches = ["ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"]
+support_searches = ["ESCU - Baseline Of Cloud Instances Destroyed", "ESCU - Baseline Of Cloud Instances Launched", "ESCU - Previously Seen Cloud Compute Creations By User - Initial", "ESCU - Previously Seen Cloud Compute Creations By User - Update", "ESCU - Previously Seen Cloud Compute Images - Initial", "ESCU - Previously Seen Cloud Compute Images - Update", "ESCU - Previously Seen Cloud Compute Instance Types - Initial", "ESCU - Previously Seen Cloud Compute Instance Types - Update", "ESCU - Previously Seen Cloud Regions - Initial", "ESCU - Previously Seen Cloud Regions - Update"]
 data_models = ["Change"]
 providing_technologies = none
 description = Monitor your cloud compute instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or compute instances started by previously unseen users are just a few examples of potentially malicious behavior.
@@ -156,7 +156,7 @@ version = 2
 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://www.tripwire.com/state-of-security/security-data-protection/cloud/public-aws-s3-buckets-writable/"]
 detection_searches = ["ESCU - Detect New Open S3 Buckets over AWS CLI - Rule", "ESCU - Detect New Open S3 buckets - Rule"]
 mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["DE.CM", "PR.AC", "PR.DS"]}
-investigative_searches = ["ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Investigate AWS activities via region name - Response Task", "ESCU - AWS S3 Bucket details via bucketName - Response Task"]
+investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS S3 Bucket details via bucketName - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"]
 support_searches = []
 data_models = []
 providing_technologies = none
@@ -176,7 +176,7 @@ reference = ["https://aws.amazon.com/blogs/security/aws-cloudtrail-now-tracks-cr
 detection_searches = ["ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule", "ESCU - Detect AWS Console Login by New User - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule"]
 mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.AE", "DE.DP", "PR.AC", "PR.DS"]}
 investigative_searches = ["ESCU - Investigate AWS User Activities by user field - Response Task"]
-support_searches = ["ESCU - Previously Seen Users in CloudTrail - Initial", "ESCU - Previously Seen AWS Cross Account Activity - Initial", "ESCU - Previously Seen Users In CloudTrail - Update", "ESCU - Previously Seen AWS Cross Account Activity - Update"]
+support_searches = ["ESCU - Previously Seen AWS Cross Account Activity - Initial", "ESCU - Previously Seen AWS Cross Account Activity - Update", "ESCU - Previously Seen Users In CloudTrail - Update", "ESCU - Previously Seen Users in CloudTrail - Initial"]
 data_models = ["Authentication"]
 providing_technologies = none
 description = Monitor your cloud authentication events. Searches within this Analytic Story leverage the recent cloud updates to the Authentication data model to help you stay aware of and investigate suspicious login activity. 
@@ -193,8 +193,8 @@ version = 1
 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
 detection_searches = ["ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule"]
 mappings = {"cis20": ["CIS 1", "CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.AE", "DE.DP", "ID.AM"]}
-investigative_searches = ["ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task"]
-support_searches = ["ESCU - Baseline Of Cloud Instances Destroyed", "ESCU - Previously Seen Cloud Instance Modifications By User - Update", "ESCU - Baseline Of Cloud Instances Launched", "ESCU - Previously Seen Cloud Instance Modifications By User - Initial"]
+investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"]
+support_searches = ["ESCU - Baseline Of Cloud Instances Destroyed", "ESCU - Baseline Of Cloud Instances Launched", "ESCU - Previously Seen Cloud Instance Modifications By User - Initial", "ESCU - Previously Seen Cloud Instance Modifications By User - Update"]
 data_models = ["Change"]
 providing_technologies = none
 description = Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment.
@@ -229,7 +229,7 @@ reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.p
 detection_searches = ["ESCU - AWS IAM AccessDenied Discovery Events - Rule", "ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule", "ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule", "ESCU - Cloud API Calls From Previously Unseen User Roles - Rule"]
 mappings = {"cis20": ["CIS 1", "CIS 16"], "kill_chain_phases": ["Actions on Objectives", "Reconnaissance"], "mitre_attack": ["T1078", "T1078.004", "T1580"], "nist": ["DE.CM", "DE.DP", "ID.AM", "PR.AC"]}
 investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task"]
-support_searches = ["ESCU - Baseline Of Cloud Infrastructure API Calls Per User", "ESCU - Previously Seen Cloud API Calls Per User Role - Update", "ESCU - Previously Seen Cloud API Calls Per User Role - Initial", "ESCU - Baseline Of Cloud Security Group API Calls Per User"]
+support_searches = ["ESCU - Baseline Of Cloud Infrastructure API Calls Per User", "ESCU - Baseline Of Cloud Security Group API Calls Per User", "ESCU - Previously Seen Cloud API Calls Per User Role - Initial", "ESCU - Previously Seen Cloud API Calls Per User Role - Update"]
 data_models = ["Change"]
 providing_technologies = none
 description = Detect and investigate suspicious activities by users and roles in your cloud environments.
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-04-29T21:11:03 UTC
+# On Date: 2021-05-13T21:47:01 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -14,7 +14,7 @@ version = 1
 references = ["https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/", "https://www.cyberark.com/resources/threat-research-blog/the-cloud-shadow-admin-threat-10-permissions-to-protect", "https://labs.bishopfox.com/tech-blog/privilege-escalation-in-aws"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}]
 spec_version = 3
-searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - AWS UpdateLoginProfile - Rule", "ESCU - AWS Create Policy Version to allow all resources - Rule", "ESCU - AWS IAM Delete Policy - Rule", "ESCU - AWS IAM Failure Group Deletion - Rule", "ESCU - AWS CreateLoginProfile - Rule", "ESCU - AWS SetDefaultPolicyVersion - Rule", "ESCU - AWS CreateAccessKey - Rule", "ESCU - AWS IAM Assume Role Policy Brute Force - Rule"]
+searches = ["ESCU - AWS Create Policy Version to allow all resources - Rule", "ESCU - AWS CreateAccessKey - Rule", "ESCU - AWS CreateLoginProfile - Rule", "ESCU - AWS IAM Assume Role Policy Brute Force - Rule", "ESCU - AWS IAM Delete Policy - Rule", "ESCU - AWS IAM Failure Group Deletion - Rule", "ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - AWS SetDefaultPolicyVersion - Rule", "ESCU - AWS UpdateLoginProfile - Rule"]
 description = This analytic story contains detections that query your AWS Cloudtrail for activities related to privilege escalation.
 narrative = Amazon Web Services provides a neat feature called Identity and Access Management (IAM) that enables organizations to manage various AWS services and resources in a secure way. All IAM users have roles, groups and policies associated with them which governs and sets permissions to allow a user to access specific restrictions.\
 However, if these IAM policies are misconfigured and have specific combinations of weak permissions; it can allow attackers to escalate their privileges and further compromise the organization. Rhino Security Labs have published comprehensive blogs detailing various AWS Escalation methods. By using this as an inspiration, Splunk’s research team wants to highlight how these attack vectors look in AWS Cloudtrail logs and provide you with detection queries to uncover these potentially malicious events via this Analytic Story. \
@@ -26,7 +26,7 @@ version = 2
 references = ["https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Appendix_NACLs.html", "https://aws.amazon.com/blogs/security/how-to-help-prepare-for-ddos-attacks-by-reducing-your-attack-surface/"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}]
 spec_version = 3
-searches = ["ESCU - AWS Network Access Control List Created with All Open Ports - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task"]
+searches = ["ESCU - AWS Network Access Control List Created with All Open Ports - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"]
 description = Monitor your AWS network infrastructure for bad configurations and malicious activity. Investigative searches help you probe deeper, when the facts warrant it.
 narrative = AWS CloudTrail is an AWS service that helps you enable governance, compliance, and operational/risk auditing of your AWS account. Actions taken by a user, role, or an AWS service are recorded as events in CloudTrail. It is crucial for a company to monitor events and actions taken in the AWS Management Console, AWS Command Line Interface, and AWS SDKs and APIs to ensure that your servers are not vulnerable to attacks. This analytic story contains detection searches that leverage CloudTrail logs from AWS to check for bad configurations and malicious activity in your AWS network access controls.

@@ -37,7 +37,7 @@ version = 1
 references = ["https://aws.amazon.com/security-hub/features/"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}]
 spec_version = 3
-searches = ["ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Launch Details - Response Task"]
+searches = ["ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task"]
 description = This story is focused around detecting Security Hub alerts generated from AWS
 narrative = AWS Security Hub collects and consolidates findings from AWS security services enabled in your environment, such as intrusion detection findings from Amazon GuardDuty, vulnerability scans from Amazon Inspector, S3 bucket policy findings from Amazon Macie, publicly accessible and cross-account resources from IAM Access Analyzer, and resources lacking WAF coverage from AWS Firewall Manager.

@@ -48,7 +48,7 @@ version = 1
 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}]
 spec_version = 3
-searches = ["ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"]
+searches = ["ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule", "ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"]
 description = Monitor your cloud compute instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or compute instances started by previously unseen users are just a few examples of potentially malicious behavior.
 narrative = Cryptomining is an intentionally difficult, resource-intensive business. Its complexity was designed into the process to ensure that the number of blocks mined each day would remain steady. So, it's par for the course that ambitious, but unscrupulous, miners make amassing the computing power of large enterprises--a practice known as cryptojacking--a top priority. \
 Cryptojacking has attracted an increasing amount of media attention since its explosion in popularity in the fall of 2017. The attacks have moved from in-browser exploits and mobile phones to enterprise cloud services, such as Amazon Web Services (AWS), Google Cloud Platform (GCP), and Azure. It's difficult to determine exactly how widespread the practice has become, since bad actors continually evolve their ability to escape detection, including employing unlisted endpoints, moderating their CPU usage, and hiding the mining pool's IP address behind a free CDN. \
@@ -62,7 +62,7 @@ version = 1
 references = ["https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps", "https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf", "https://us-cert.cisa.gov/ncas/alerts/aa21-008a"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Rod Soto"}]
 spec_version = 3
-searches = ["ESCU - AWS SAML Update identity provider - Rule", "ESCU - O365 New Federated Domain Added - Rule", "ESCU - O365 Added Service Principal - Rule", "ESCU - O365 Excessive SSO logon errors - Rule", "ESCU - O365 Add App Role Assignment Grant User - Rule", "ESCU - AWS SAML Access by Provider User and Principal - Rule"]
+searches = ["ESCU - AWS SAML Access by Provider User and Principal - Rule", "ESCU - AWS SAML Update identity provider - Rule", "ESCU - O365 Add App Role Assignment Grant User - Rule", "ESCU - O365 Added Service Principal - Rule", "ESCU - O365 Excessive SSO logon errors - Rule", "ESCU - O365 New Federated Domain Added - Rule"]
 description = This analytical story addresses events that indicate abuse of cloud federated credentials. These credentials are usually extracted from endpoint desktop or servers specially those servers that provide federation services such as Windows Active Directory Federation Services. Identity Federation relies on objects such as Oauth2 tokens, cookies or SAML assertions in order to provide seamless access between cloud and perimeter environments. If these objects are either hijacked or forged then attackers will be able to pivot into victim's cloud environements.
 narrative = This story is composed of detection searches based on endpoint that addresses the use of Mimikatz, Escalation of Privileges and Abnormal processes that may indicate the extraction of Federated directory objects such as passwords, Oauth2 tokens, certificates and keys. Cloud environment (AWS, Azure) related events are also addressed in specific cloud environment detection searches.

@@ -73,7 +73,7 @@ version = 1
 references = ["https://i.blackhat.com/USA-20/Thursday/us-20-Bienstock-My-Cloud-Is-APTs-Cloud-Investigating-And-Defending-Office-365.pdf"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Patrick Bareiss"}]
 spec_version = 3
-searches = ["ESCU - O365 New Federated Domain Added - Rule", "ESCU - O365 Disable MFA - Rule", "ESCU - O365 Added Service Principal - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Excessive SSO logon errors - Rule", "ESCU - O365 Add App Role Assignment Grant User - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule", "ESCU - O365 Excessive Authentication Failures Alert - Rule", "ESCU - O365 Suspicious Rights Delegation - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Bypass MFA via Trusted IP - Rule"]
+searches = ["ESCU - O365 Add App Role Assignment Grant User - Rule", "ESCU - O365 Added Service Principal - Rule", "ESCU - O365 Bypass MFA via Trusted IP - Rule", "ESCU - O365 Disable MFA - Rule", "ESCU - O365 Excessive Authentication Failures Alert - Rule", "ESCU - O365 Excessive SSO logon errors - Rule", "ESCU - O365 New Federated Domain Added - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Suspicious Rights Delegation - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule"]
 description = This story is focused around detecting Office 365 Attacks.
 narrative = More and more companies are using Microsofts Office 365 cloud offering. Therefore, we see more and more attacks against Office 365. This story provides various detections for Office 365 attacks.

@@ -84,7 +84,7 @@ version = 1
 references = ["https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/", "https://github.com/d1vious/git-wild-hunt", "https://www.youtube.com/watch?v=PgzNib37g0M"]
 maintainers = [{"company": "David Dorsey, Splunk", "email": "-", "name": "Rod Soto"}]
 spec_version = 3
-searches = ["ESCU - AWS Detect Users with KMS keys performing encryption S3 - Rule", "ESCU - AWS Detect Users creating keys with encrypt policy without MFA - Rule"]
+searches = ["ESCU - AWS Detect Users creating keys with encrypt policy without MFA - Rule", "ESCU - AWS Detect Users with KMS keys performing encryption S3 - Rule"]
 description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware. These searches include cloud related objects that may be targeted by malicious actors via cloud providers own encryption features.
 narrative = Ransomware is an ever-present risk to the enterprise, wherein an infected host encrypts business-critical data, holding it hostage until the victim pays the attacker a ransom. There are many types and varieties of ransomware that can affect an enterprise.Cloud ransomware can be deployed by obtaining high privilege credentials from targeted users or resources.

@@ -95,7 +95,7 @@ version = 1
 references = ["https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}]
 spec_version = 3
-searches = ["ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task"]
+searches = ["ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task"]
 description = Monitor your AWS authentication events using your CloudTrail logs. Searches within this Analytic Story will help you stay aware of and investigate suspicious logins. 
 narrative = It is important to monitor and control who has access to your AWS infrastructure. Detecting suspicious logins to your AWS infrastructure will provide good starting points for investigations. Abusive behaviors caused by compromised credentials can lead to direct monetary costs, as you will be billed for any EC2 instances created by the attacker.

@@ -106,7 +106,7 @@ version = 2
 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://www.tripwire.com/state-of-security/security-data-protection/cloud/public-aws-s3-buckets-writable/"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}]
 spec_version = 3
-searches = ["ESCU - Detect New Open S3 buckets - Rule", "ESCU - Detect New Open S3 Buckets over AWS CLI - Rule", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Investigate AWS activities via region name - Response Task", "ESCU - AWS S3 Bucket details via bucketName - Response Task"]
+searches = ["ESCU - Detect New Open S3 Buckets over AWS CLI - Rule", "ESCU - Detect New Open S3 buckets - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS S3 Bucket details via bucketName - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"]
 description = Use the searches in this Analytic Story to monitor your AWS S3 buckets for evidence of anomalous activity and suspicious behaviors, such as detecting open S3 buckets and buckets being accessed from a new IP. The contextual and investigative searches will give you more information, when required.
 narrative = As cloud computing has exploded, so has the number of creative attacks on virtual environments. And as the number-two cloud-service provider, Amazon Web Services (AWS) has certainly had its share.\
 Amazon's "shared responsibility" model dictates that the company has responsibility for the environment outside of the VM and the customer is responsible for the security inside of the S3 container. As such, it's important to stay vigilant for activities that may belie suspicious behavior inside of your environment.\
@@ -119,7 +119,7 @@ version = 1
 references = ["https://aws.amazon.com/blogs/security/aws-cloudtrail-now-tracks-cross-account-activity-to-its-origin/", "https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}]
 spec_version = 3
-searches = ["ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by New User - Rule", "ESCU - Investigate AWS User Activities by user field - Response Task"]
+searches = ["ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule", "ESCU - Detect AWS Console Login by New User - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Investigate AWS User Activities by user field - Response Task"]
 description = Monitor your cloud authentication events. Searches within this Analytic Story leverage the recent cloud updates to the Authentication data model to help you stay aware of and investigate suspicious login activity. 
 narrative = It is important to monitor and control who has access to your cloud infrastructure. Detecting suspicious logins will provide good starting points for investigations. Abusive behaviors caused by compromised credentials can lead to direct monetary costs, as you will be billed for any compute activity whether legitimate or otherwise.\
 This Analytic Story has data model versions of cloud searches leveraging Authentication data, including those looking for suspicious login activity, and cross-account activity for AWS.
@@ -131,7 +131,7 @@ version = 1
 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}]
 spec_version = 3
-searches = ["ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task"]
+searches = ["ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"]
 description = Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment.
 narrative = Monitoring your cloud infrastructure logs allows you enable governance, compliance, and risk auditing. It is crucial for a company to monitor events and actions taken in the their cloud environments to ensure that your instances are not vulnerable to attacks. This Analytic Story identifies suspicious activities in your cloud compute instances and helps you respond and investigate those activities.

@@ -142,7 +142,7 @@ version = 1
 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}]
 spec_version = 3
-searches = ["ESCU - Cloud Provisioning Activity From Previously Unseen IP Address - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen City - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Region - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Country - Rule"]
+searches = ["ESCU - Cloud Provisioning Activity From Previously Unseen City - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Country - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen IP Address - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Region - Rule"]
 description = Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment.
 narrative = Because most enterprise cloud infrastructure activities originate from familiar geographic locations, monitoring for activity from unknown or unusual regions is an important security measure. This indicator can be especially useful in environments where it is impossible to add specific IPs to an allow list because they vary.\
 This Analytic Story was designed to provide you with flexibility in the precision you employ in specifying legitimate geographic regions. It can be as specific as an IP address or a city, or as broad as a region (think state) or an entire country. By determining how precise you want your geographical locations to be and monitoring for new locations that haven't previously accessed your environment, you can detect adversaries as they begin to probe your environment. Since there are legitimate reasons for activities from unfamiliar locations, this is not a standalone indicator. Nevertheless, location can be a relevant piece of information that you may wish to investigate further.
@@ -154,7 +154,7 @@ version = 1
 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://redlock.io/blog/cryptojacking-tesla"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}]
 spec_version = 3
-searches = ["ESCU - Cloud API Calls From Previously Unseen User Roles - Rule", "ESCU - AWS IAM AccessDenied Discovery Events - Rule", "ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule", "ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task"]
+searches = ["ESCU - AWS IAM AccessDenied Discovery Events - Rule", "ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule", "ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule", "ESCU - Cloud API Calls From Previously Unseen User Roles - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task"]
 description = Detect and investigate suspicious activities by users and roles in your cloud environments.
 narrative = It seems obvious that it is critical to monitor and control the users who have access to your cloud infrastructure. Nevertheless, it's all too common for enterprises to lose track of ad-hoc accounts, leaving their servers vulnerable to attack. In fact, this was the very oversight that led to Tesla's cryptojacking attack in February, 2018.\
 In addition to compromising the security of your data, when bad actors leverage your compute resources, it can incur monumental costs, since you will be billed for any new instances and increased bandwidth usage.
@@ -4,7 +4,7 @@
 is_configured = false
 state = enabled
 state_change_requires_restart = false
-build = 27601
+build = 28811

 [triggers]
 reload.analytic_stories = simple
@@ -18,7 +18,7 @@ reload.content-version = simple

 [launcher]
 author = Splunk
-version = 3.20.0
+version = 3.21.0
 description = Explore the Analytic Stories included with Splunk Security Analytics for AWS Content

 [ui]
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-04-29T21:11:03 UTC
+# On Date: 2021-05-13T21:47:01 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,2 +1,2 @@
 [content-version]
-version = 3.20.0
+version = 3.21.0
@@ -11,21 +11,21 @@ label = AWS Network ACL Activity
 description = Monitor your AWS network infrastructure for bad configurations and malicious activity. Investigative searches help you probe deeper, when the facts warrant it.
 disabled = 0

-panels = ["panel://workbench_panel_get_all_aws_activity_from_ip_address___response_task", "panel://workbench_panel_aws_network_acl_details_from_id___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_aws_network_interface_details_via_resourceid___response_task"]
+panels = ["panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_aws_network_acl_details_from_id___response_task", "panel://workbench_panel_aws_network_interface_details_via_resourceid___response_task", "panel://workbench_panel_get_all_aws_activity_from_ip_address___response_task"]

 [panel_group://workbench_panel_group_aws_security_hub_alerts]
 label = AWS Security Hub Alerts
 description = This story is focused around detecting Security Hub alerts generated from AWS
 disabled = 0

-panels = ["panel://workbench_panel_get_ec2_instance_details_by_instanceid___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_ec2_launch_details___response_task"]
+panels = ["panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_ec2_instance_details_by_instanceid___response_task", "panel://workbench_panel_get_ec2_launch_details___response_task"]

 [panel_group://workbench_panel_group_cloud_cryptomining]
 label = Cloud Cryptomining
 description = Monitor your cloud compute instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or compute instances started by previously unseen users are just a few examples of potentially malicious behavior.
 disabled = 0

-panels = ["panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_ec2_instance_details_by_instanceid___response_task", "panel://workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task", "panel://workbench_panel_get_ec2_launch_details___response_task", "panel://workbench_panel_investigate_aws_activities_via_region_name___response_task"]
+panels = ["panel://workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_ec2_instance_details_by_instanceid___response_task", "panel://workbench_panel_get_ec2_launch_details___response_task", "panel://workbench_panel_investigate_aws_activities_via_region_name___response_task"]

 [panel_group://workbench_panel_group_cloud_federated_credential_abuse]
 label = Cloud Federated Credential Abuse
@@ -60,7 +60,7 @@ label = Suspicious AWS S3 Activities
 description = Use the searches in this Analytic Story to monitor your AWS S3 buckets for evidence of anomalous activity and suspicious behaviors, such as detecting open S3 buckets and buckets being accessed from a new IP. The contextual and investigative searches will give you more information, when required.
 disabled = 0

-panels = ["panel://workbench_panel_get_all_aws_activity_from_ip_address___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_investigate_aws_activities_via_region_name___response_task", "panel://workbench_panel_aws_s3_bucket_details_via_bucketname___response_task"]
+panels = ["panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_aws_s3_bucket_details_via_bucketname___response_task", "panel://workbench_panel_get_all_aws_activity_from_ip_address___response_task", "panel://workbench_panel_investigate_aws_activities_via_region_name___response_task"]

 [panel_group://workbench_panel_group_suspicious_cloud_authentication_activities]
 label = Suspicious Cloud Authentication Activities
@@ -74,7 +74,7 @@ label = Suspicious Cloud Instance Activities
 description = Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment.
 disabled = 0

-panels = ["panel://workbench_panel_get_all_aws_activity_from_ip_address___response_task", "panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task"]
+panels = ["panel://workbench_panel_aws_investigate_user_activities_by_arn___response_task", "panel://workbench_panel_get_all_aws_activity_from_ip_address___response_task"]

 [panel_group://workbench_panel_group_suspicious_cloud_provisioning_activities]
 label = Suspicious Cloud Provisioning Activities
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-04-29T21:11:03 UTC
+# On Date: 2021-05-13T21:47:01 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -142,6 +142,10 @@ description = customer specific splunk configurations(eg- index, source, sourcet
 definition = eventtype="osquery-process"
 description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

+[powershell]
+definition = sourcetype=wineventlog OR source=WinEventLog:Microsoft-Windows-PowerShell/Operational
+description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
+
 [previously_seen_cloud_api_calls_per_user_role_forget_window]
 definition = "-90d@d"
 description = Use this macro to determine how long to keep track of cloud api calls per user role
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-04-29T21:11:03 UTC
+# On Date: 2021-05-13T21:47:01 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-04-29T21:11:03 UTC
+# On Date: 2021-05-13T21:47:01 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-04-29T21:11:03 UTC
+# On Date: 2021-05-13T21:47:01 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -14,7 +14,7 @@ version = 1
 references = ["https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/", "https://www.cyberark.com/resources/threat-research-blog/the-cloud-shadow-admin-threat-10-permissions-to-protect", "https://labs.bishopfox.com/tech-blog/privilege-escalation-in-aws"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}]
 spec_version = 3
-searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - AWS UpdateLoginProfile - Rule", "ESCU - AWS Create Policy Version to allow all resources - Rule", "ESCU - AWS IAM Delete Policy - Rule", "ESCU - AWS IAM Failure Group Deletion - Rule", "ESCU - AWS CreateLoginProfile - Rule", "ESCU - AWS SetDefaultPolicyVersion - Rule", "ESCU - AWS CreateAccessKey - Rule", "ESCU - AWS IAM Assume Role Policy Brute Force - Rule"]
+searches = ["ESCU - AWS Create Policy Version to allow all resources - Rule", "ESCU - AWS CreateAccessKey - Rule", "ESCU - AWS CreateLoginProfile - Rule", "ESCU - AWS IAM Assume Role Policy Brute Force - Rule", "ESCU - AWS IAM Delete Policy - Rule", "ESCU - AWS IAM Failure Group Deletion - Rule", "ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - AWS SetDefaultPolicyVersion - Rule", "ESCU - AWS UpdateLoginProfile - Rule"]
 description = This analytic story contains detections that query your AWS Cloudtrail for activities related to privilege escalation.
 narrative = Amazon Web Services provides a neat feature called Identity and Access Management (IAM) that enables organizations to manage various AWS services and resources in a secure way. All IAM users have roles, groups and policies associated with them which governs and sets permissions to allow a user to access specific restrictions.\
 However, if these IAM policies are misconfigured and have specific combinations of weak permissions; it can allow attackers to escalate their privileges and further compromise the organization. Rhino Security Labs have published comprehensive blogs detailing various AWS Escalation methods. By using this as an inspiration, Splunk’s research team wants to highlight how these attack vectors look in AWS Cloudtrail logs and provide you with detection queries to uncover these potentially malicious events via this Analytic Story. \
@@ -26,7 +26,7 @@ version = 2
 references = ["https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Appendix_NACLs.html", "https://aws.amazon.com/blogs/security/how-to-help-prepare-for-ddos-attacks-by-reducing-your-attack-surface/"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}]
 spec_version = 3
-searches = ["ESCU - AWS Network Access Control List Created with All Open Ports - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task"]
+searches = ["ESCU - AWS Network Access Control List Created with All Open Ports - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"]
 description = Monitor your AWS network infrastructure for bad configurations and malicious activity. Investigative searches help you probe deeper, when the facts warrant it.
 narrative = AWS CloudTrail is an AWS service that helps you enable governance, compliance, and operational/risk auditing of your AWS account. Actions taken by a user, role, or an AWS service are recorded as events in CloudTrail. It is crucial for a company to monitor events and actions taken in the AWS Management Console, AWS Command Line Interface, and AWS SDKs and APIs to ensure that your servers are not vulnerable to attacks. This analytic story contains detection searches that leverage CloudTrail logs from AWS to check for bad configurations and malicious activity in your AWS network access controls.

@@ -37,7 +37,7 @@ version = 1
 references = ["https://aws.amazon.com/security-hub/features/"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}]
 spec_version = 3
-searches = ["ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Launch Details - Response Task"]
+searches = ["ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task"]
 description = This story is focused around detecting Security Hub alerts generated from AWS
 narrative = AWS Security Hub collects and consolidates findings from AWS security services enabled in your environment, such as intrusion detection findings from Amazon GuardDuty, vulnerability scans from Amazon Inspector, S3 bucket policy findings from Amazon Macie, publicly accessible and cross-account resources from IAM Access Analyzer, and resources lacking WAF coverage from AWS Firewall Manager.

@@ -48,7 +48,7 @@ version = 1
 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}]
 spec_version = 3
-searches = ["ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"]
+searches = ["ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule", "ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"]
 description = Monitor your cloud compute instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or compute instances started by previously unseen users are just a few examples of potentially malicious behavior.
 narrative = Cryptomining is an intentionally difficult, resource-intensive business. Its complexity was designed into the process to ensure that the number of blocks mined each day would remain steady. So, it's par for the course that ambitious, but unscrupulous, miners make amassing the computing power of large enterprises--a practice known as cryptojacking--a top priority. \
 Cryptojacking has attracted an increasing amount of media attention since its explosion in popularity in the fall of 2017. The attacks have moved from in-browser exploits and mobile phones to enterprise cloud services, such as Amazon Web Services (AWS), Google Cloud Platform (GCP), and Azure. It's difficult to determine exactly how widespread the practice has become, since bad actors continually evolve their ability to escape detection, including employing unlisted endpoints, moderating their CPU usage, and hiding the mining pool's IP address behind a free CDN. \
@@ -62,7 +62,7 @@ version = 1
 references = ["https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps", "https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf", "https://us-cert.cisa.gov/ncas/alerts/aa21-008a"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Rod Soto"}]
 spec_version = 3
-searches = ["ESCU - AWS SAML Update identity provider - Rule", "ESCU - O365 New Federated Domain Added - Rule", "ESCU - O365 Added Service Principal - Rule", "ESCU - O365 Excessive SSO logon errors - Rule", "ESCU - O365 Add App Role Assignment Grant User - Rule", "ESCU - AWS SAML Access by Provider User and Principal - Rule"]
+searches = ["ESCU - AWS SAML Access by Provider User and Principal - Rule", "ESCU - AWS SAML Update identity provider - Rule", "ESCU - O365 Add App Role Assignment Grant User - Rule", "ESCU - O365 Added Service Principal - Rule", "ESCU - O365 Excessive SSO logon errors - Rule", "ESCU - O365 New Federated Domain Added - Rule"]
 description = This analytical story addresses events that indicate abuse of cloud federated credentials. These credentials are usually extracted from endpoint desktop or servers specially those servers that provide federation services such as Windows Active Directory Federation Services. Identity Federation relies on objects such as Oauth2 tokens, cookies or SAML assertions in order to provide seamless access between cloud and perimeter environments. If these objects are either hijacked or forged then attackers will be able to pivot into victim's cloud environements.
 narrative = This story is composed of detection searches based on endpoint that addresses the use of Mimikatz, Escalation of Privileges and Abnormal processes that may indicate the extraction of Federated directory objects such as passwords, Oauth2 tokens, certificates and keys. Cloud environment (AWS, Azure) related events are also addressed in specific cloud environment detection searches.

@@ -73,7 +73,7 @@ version = 1
 references = ["https://i.blackhat.com/USA-20/Thursday/us-20-Bienstock-My-Cloud-Is-APTs-Cloud-Investigating-And-Defending-Office-365.pdf"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Patrick Bareiss"}]
 spec_version = 3
-searches = ["ESCU - O365 New Federated Domain Added - Rule", "ESCU - O365 Disable MFA - Rule", "ESCU - O365 Added Service Principal - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Excessive SSO logon errors - Rule", "ESCU - O365 Add App Role Assignment Grant User - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule", "ESCU - O365 Excessive Authentication Failures Alert - Rule", "ESCU - O365 Suspicious Rights Delegation - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Bypass MFA via Trusted IP - Rule"]
+searches = ["ESCU - O365 Add App Role Assignment Grant User - Rule", "ESCU - O365 Added Service Principal - Rule", "ESCU - O365 Bypass MFA via Trusted IP - Rule", "ESCU - O365 Disable MFA - Rule", "ESCU - O365 Excessive Authentication Failures Alert - Rule", "ESCU - O365 Excessive SSO logon errors - Rule", "ESCU - O365 New Federated Domain Added - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Suspicious Rights Delegation - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule"]
 description = This story is focused around detecting Office 365 Attacks.
 narrative = More and more companies are using Microsofts Office 365 cloud offering. Therefore, we see more and more attacks against Office 365. This story provides various detections for Office 365 attacks.

@@ -84,7 +84,7 @@ version = 1
 references = ["https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/", "https://github.com/d1vious/git-wild-hunt", "https://www.youtube.com/watch?v=PgzNib37g0M"]
 maintainers = [{"company": "David Dorsey, Splunk", "email": "-", "name": "Rod Soto"}]
 spec_version = 3
-searches = ["ESCU - AWS Detect Users with KMS keys performing encryption S3 - Rule", "ESCU - AWS Detect Users creating keys with encrypt policy without MFA - Rule"]
+searches = ["ESCU - AWS Detect Users creating keys with encrypt policy without MFA - Rule", "ESCU - AWS Detect Users with KMS keys performing encryption S3 - Rule"]
 description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware. These searches include cloud related objects that may be targeted by malicious actors via cloud providers own encryption features.
 narrative = Ransomware is an ever-present risk to the enterprise, wherein an infected host encrypts business-critical data, holding it hostage until the victim pays the attacker a ransom. There are many types and varieties of ransomware that can affect an enterprise.Cloud ransomware can be deployed by obtaining high privilege credentials from targeted users or resources.

@@ -95,7 +95,7 @@ version = 1
 references = ["https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}]
 spec_version = 3
-searches = ["ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task"]
+searches = ["ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task"]
 description = Monitor your AWS authentication events using your CloudTrail logs. Searches within this Analytic Story will help you stay aware of and investigate suspicious logins. 
 narrative = It is important to monitor and control who has access to your AWS infrastructure. Detecting suspicious logins to your AWS infrastructure will provide good starting points for investigations. Abusive behaviors caused by compromised credentials can lead to direct monetary costs, as you will be billed for any EC2 instances created by the attacker.

@@ -106,7 +106,7 @@ version = 2
 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://www.tripwire.com/state-of-security/security-data-protection/cloud/public-aws-s3-buckets-writable/"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}]
 spec_version = 3
-searches = ["ESCU - Detect New Open S3 buckets - Rule", "ESCU - Detect New Open S3 Buckets over AWS CLI - Rule", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Investigate AWS activities via region name - Response Task", "ESCU - AWS S3 Bucket details via bucketName - Response Task"]
+searches = ["ESCU - Detect New Open S3 Buckets over AWS CLI - Rule", "ESCU - Detect New Open S3 buckets - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS S3 Bucket details via bucketName - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"]
 description = Use the searches in this Analytic Story to monitor your AWS S3 buckets for evidence of anomalous activity and suspicious behaviors, such as detecting open S3 buckets and buckets being accessed from a new IP. The contextual and investigative searches will give you more information, when required.
 narrative = As cloud computing has exploded, so has the number of creative attacks on virtual environments. And as the number-two cloud-service provider, Amazon Web Services (AWS) has certainly had its share.\
 Amazon's "shared responsibility" model dictates that the company has responsibility for the environment outside of the VM and the customer is responsible for the security inside of the S3 container. As such, it's important to stay vigilant for activities that may belie suspicious behavior inside of your environment.\
@@ -119,7 +119,7 @@ version = 1
 references = ["https://aws.amazon.com/blogs/security/aws-cloudtrail-now-tracks-cross-account-activity-to-its-origin/", "https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}]
 spec_version = 3
-searches = ["ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by New User - Rule", "ESCU - Investigate AWS User Activities by user field - Response Task"]
+searches = ["ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule", "ESCU - Detect AWS Console Login by New User - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Investigate AWS User Activities by user field - Response Task"]
 description = Monitor your cloud authentication events. Searches within this Analytic Story leverage the recent cloud updates to the Authentication data model to help you stay aware of and investigate suspicious login activity. 
 narrative = It is important to monitor and control who has access to your cloud infrastructure. Detecting suspicious logins will provide good starting points for investigations. Abusive behaviors caused by compromised credentials can lead to direct monetary costs, as you will be billed for any compute activity whether legitimate or otherwise.\
 This Analytic Story has data model versions of cloud searches leveraging Authentication data, including those looking for suspicious login activity, and cross-account activity for AWS.
@@ -131,7 +131,7 @@ version = 1
 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}]
 spec_version = 3
-searches = ["ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task"]
+searches = ["ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"]
 description = Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment.
 narrative = Monitoring your cloud infrastructure logs allows you enable governance, compliance, and risk auditing. It is crucial for a company to monitor events and actions taken in the their cloud environments to ensure that your instances are not vulnerable to attacks. This Analytic Story identifies suspicious activities in your cloud compute instances and helps you respond and investigate those activities.

@@ -142,7 +142,7 @@ version = 1
 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}]
 spec_version = 3
-searches = ["ESCU - Cloud Provisioning Activity From Previously Unseen IP Address - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen City - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Region - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Country - Rule"]
+searches = ["ESCU - Cloud Provisioning Activity From Previously Unseen City - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Country - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen IP Address - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Region - Rule"]
 description = Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment.
 narrative = Because most enterprise cloud infrastructure activities originate from familiar geographic locations, monitoring for activity from unknown or unusual regions is an important security measure. This indicator can be especially useful in environments where it is impossible to add specific IPs to an allow list because they vary.\
 This Analytic Story was designed to provide you with flexibility in the precision you employ in specifying legitimate geographic regions. It can be as specific as an IP address or a city, or as broad as a region (think state) or an entire country. By determining how precise you want your geographical locations to be and monitoring for new locations that haven't previously accessed your environment, you can detect adversaries as they begin to probe your environment. Since there are legitimate reasons for activities from unfamiliar locations, this is not a standalone indicator. Nevertheless, location can be a relevant piece of information that you may wish to investigate further.
@@ -154,7 +154,7 @@ version = 1
 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://redlock.io/blog/cryptojacking-tesla"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}]
 spec_version = 3
-searches = ["ESCU - Cloud API Calls From Previously Unseen User Roles - Rule", "ESCU - AWS IAM AccessDenied Discovery Events - Rule", "ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule", "ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task"]
+searches = ["ESCU - AWS IAM AccessDenied Discovery Events - Rule", "ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule", "ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule", "ESCU - Cloud API Calls From Previously Unseen User Roles - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task"]
 description = Detect and investigate suspicious activities by users and roles in your cloud environments.
 narrative = It seems obvious that it is critical to monitor and control the users who have access to your cloud infrastructure. Nevertheless, it's all too common for enterprises to lose track of ad-hoc accounts, leaving their servers vulnerable to attack. In fact, this was the very oversight that led to Tesla's cryptojacking attack in February, 2018.\
 In addition to compromising the security of your data, when bad actors leverage your compute resources, it can incur monumental costs, since you will be billed for any new instances and increased bandwidth usage.
@@ -284,6 +284,61 @@ _version_: 1
 <details>
  <summary>details</summary>

+### Active Directory Password Spraying
+Monitor for activities and techniques associated with Password Spraying attacks within Active Directory environments.
+
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: Endpoint
+- **ATT&CK**: [T1110.003](https://attack.mitre.org/techniques/T1110.003/)
+- **Last Updated**: 2021-04-07
+
+<details>
+  <summary>details</summary>
+
+#### Detection Profile
+
+* [Multiple Disabled Users Failing To Authenticate From Host Using Kerberos](detections.md#multiple-disabled-users-failing-to-authenticate-from-host-using-kerberos)
+
+* [Multiple Invalid Users Failing To Authenticate From Host Using Kerberos](detections.md#multiple-invalid-users-failing-to-authenticate-from-host-using-kerberos)
+
+* [Multiple Invalid Users Failing To Authenticate From Host Using NTLM](detections.md#multiple-invalid-users-failing-to-authenticate-from-host-using-ntlm)
+
+* [Multiple Users Attempting To Authenticate Using Explicit Credentials](detections.md#multiple-users-attempting-to-authenticate-using-explicit-credentials)
+
+* [Multiple Users Failing To Authenticate From Host Using Kerberos](detections.md#multiple-users-failing-to-authenticate-from-host-using-kerberos)
+
+* [Multiple Users Failing To Authenticate From Host Using NTLM](detections.md#multiple-users-failing-to-authenticate-from-host-using-ntlm)
+
+* [Multiple Users Failing To Authenticate From Process](detections.md#multiple-users-failing-to-authenticate-from-process)
+
+* [Multiple Users Remotely Failing To Authenticate From Host](detections.md#multiple-users-remotely-failing-to-authenticate-from-host)
+
+
+#### ATT&CK
+
+| ID          | Technique   | Tactic       |
+| ----------- | ----------- |--------------|
+| T1110.003 | Password Spraying | Credential Access |
+
+#### Kill Chain Phase
+
+* Exploitation
+
+
+#### Reference
+
+* https://attack.mitre.org/techniques/T1110/003/
+
+* https://www.microsoft.com/security/blog/2020/04/23/protecting-organization-password-spray-attacks/
+
+* https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn452415(v=ws.11)
+
+
+_version_: 1
+</details>
+
+---
+
 ### BITS Jobs
 Adversaries may abuse BITS jobs to persistently execute or clean up after malicious payloads.

@@ -712,6 +767,8 @@ Uncover activity consistent with credential dumping, a technique wherein attacke

 * [Dump LSASS via procdump Rename](detections.md#dump-lsass-via-procdump-rename)

+* [Extract SAM from Registry](detections.md#extract-sam-from-registry)
+
 * [Ntdsutil Export NTDS](detections.md#ntdsutil-export-ntds)

 * [Set Default PowerShell Execution Policy To Unrestricted or Bypass](detections.md#set-default-powershell-execution-policy-to-unrestricted-or-bypass)
@@ -749,6 +806,8 @@ Uncover activity consistent with credential dumping, a technique wherein attacke

 * Actions on Objectives

+* Exploitation
+
 * Installation


@@ -2549,6 +2608,10 @@ Detect tactics used by malware to evade defenses on Windows endpoints. A few of

 * [Remote Registry Key modifications](detections.md#remote-registry-key-modifications)

+* [SLUI RunAs Elevated](detections.md#slui-runas-elevated)
+
+* [SLUI Spawning a Process](detections.md#slui-spawning-a-process)
+
 * [Suspicious Reg exe Process](detections.md#suspicious-reg-exe-process)

 * [System Process Running from Unexpected Location](detections.md#system-process-running-from-unexpected-location)
@@ -2779,6 +2842,10 @@ Monitor for activities and techniques associated with maintaining persistence on

 * [Sc exe Manipulating Windows Services](detections.md#sc-exe-manipulating-windows-services)

+* [Schedule Task with HTTP Command Arguments](detections.md#schedule-task-with-http-command-arguments)
+
+* [Schedule Task with Rundll32 Command Trigger](detections.md#schedule-task-with-rundll32-command-trigger)
+
 * [Schtasks used for forcing a reboot](detections.md#schtasks-used-for-forcing-a-reboot)

 * [Setting Credentials via DSInternals modules](detections.md#setting-credentials-via-dsinternals-modules)
@@ -2787,8 +2854,6 @@ Monitor for activities and techniques associated with maintaining persistence on

 * [Setting Credentials via PowerSploit modules](detections.md#setting-credentials-via-powersploit-modules)

-* [Shedule Task with HTTP Command Arguments](detections.md#shedule-task-with-http-command-arguments)
-
 * [Shim Database File Creation](detections.md#shim-database-file-creation)

 * [Shim Database Installation With Suspicious Parameters](detections.md#shim-database-installation-with-suspicious-parameters)
@@ -4606,6 +4671,89 @@ _version_: 2

 ---

+### DarkSide Ransomware
+Leverage searches that allow you to detect and investigate unusual activities that might relate to the DarkSide Ransomware
+
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: Endpoint
+- **ATT&CK**: [T1003.001](https://attack.mitre.org/techniques/T1003.001/), [T1003.002](https://attack.mitre.org/techniques/T1003.002/), [T1020](https://attack.mitre.org/techniques/T1020/), [T1021.002](https://attack.mitre.org/techniques/T1021.002/), [T1055](https://attack.mitre.org/techniques/T1055/), [T1105](https://attack.mitre.org/techniques/T1105/), [T1197](https://attack.mitre.org/techniques/T1197/), [T1218.003](https://attack.mitre.org/techniques/T1218.003/), [T1486](https://attack.mitre.org/techniques/T1486/), [T1490](https://attack.mitre.org/techniques/T1490/), [T1548.002](https://attack.mitre.org/techniques/T1548.002/)
+- **Last Updated**: 2020-06-12
+
+<details>
+  <summary>details</summary>
+
+#### Detection Profile
+
+* [Attempted Credential Dump From Registry via Reg exe](detections.md#attempted-credential-dump-from-registry-via-reg-exe)
+
+* [BITSAdmin Download File](detections.md#bitsadmin-download-file)
+
+* [CMLUA Or CMSTPLUA UAC Bypass](detections.md#cmlua-or-cmstplua-uac-bypass)
+
+* [CertUtil Download With URLCache and Split Arguments](detections.md#certutil-download-with-urlcache-and-split-arguments)
+
+* [CertUtil Download With VerifyCtl and Split Arguments](detections.md#certutil-download-with-verifyctl-and-split-arguments)
+
+* [Cobalt Strike Named Pipes](detections.md#cobalt-strike-named-pipes)
+
+* [Delete ShadowCopy With PowerShell](detections.md#delete-shadowcopy-with-powershell)
+
+* [Detect Mimikatz Using Loaded Images](detections.md#detect-mimikatz-using-loaded-images)
+
+* [Detect PsExec With accepteula Flag](detections.md#detect-psexec-with-accepteula-flag)
+
+* [Detect RClone Command-Line Usage](detections.md#detect-rclone-command-line-usage)
+
+* [Detect Renamed RClone](detections.md#detect-renamed-rclone)
+
+* [Extract SAM from Registry](detections.md#extract-sam-from-registry)
+
+* [Ransomware Notes bulk creation](detections.md#ransomware-notes-bulk-creation)
+
+* [SLUI RunAs Elevated](detections.md#slui-runas-elevated)
+
+* [SLUI Spawning a Process](detections.md#slui-spawning-a-process)
+
+
+#### ATT&CK
+
+| ID          | Technique   | Tactic       |
+| ----------- | ----------- |--------------|
+| T1003.002 | Security Account Manager | Credential Access |
+| T1197 | BITS Jobs | Defense Evasion, Persistence |
+| T1105 | Ingress Tool Transfer | Command and Control |
+| T1218.003 | CMSTP | Defense Evasion |
+| T1055 | Process Injection | Defense Evasion, Privilege Escalation |
+| T1490 | Inhibit System Recovery | Impact |
+| T1003.001 | LSASS Memory | Credential Access |
+| T1021.002 | SMB/Windows Admin Shares | Lateral Movement |
+| T1020 | Automated Exfiltration | Exfiltration |
+| T1486 | Data Encrypted for Impact | Impact |
+| T1548.002 | Bypass User Account Control | Defense Evasion, Privilege Escalation |
+
+#### Kill Chain Phase
+
+* Actions on Objectives
+
+* Exfiltration
+
+* Exploitation
+
+* Obfuscation
+
+
+#### Reference
+
+* https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/
+
+* https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html
+
+
+_version_: 1
+</details>
+
+---
+
 ### Dynamic DNS
 Detect and investigate hosts in your environment that may be communicating with dynamic domain providers. Attackers may leverage these services to help them avoid firewall blocks and deny lists.

@@ -4855,7 +5003,7 @@ Leverage searches that allow you to detect and investigate unusual activities th

 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: Endpoint, Network_Traffic
- **ATT&CK**: [T1021.002](https://attack.mitre.org/techniques/T1021.002/), [T1036.003](https://attack.mitre.org/techniques/T1036.003/), [T1047](https://attack.mitre.org/techniques/T1047/), [T1048](https://attack.mitre.org/techniques/T1048/), [T1053.005](https://attack.mitre.org/techniques/T1053.005/), [T1070](https://attack.mitre.org/techniques/T1070/), [T1070.001](https://attack.mitre.org/techniques/T1070.001/), [T1071.001](https://attack.mitre.org/techniques/T1071.001/), [T1485](https://attack.mitre.org/techniques/T1485/), [T1490](https://attack.mitre.org/techniques/T1490/), [T1547.001](https://attack.mitre.org/techniques/T1547.001/)
+- **ATT&CK**: [T1020](https://attack.mitre.org/techniques/T1020/), [T1021.002](https://attack.mitre.org/techniques/T1021.002/), [T1036.003](https://attack.mitre.org/techniques/T1036.003/), [T1047](https://attack.mitre.org/techniques/T1047/), [T1048](https://attack.mitre.org/techniques/T1048/), [T1053.005](https://attack.mitre.org/techniques/T1053.005/), [T1070](https://attack.mitre.org/techniques/T1070/), [T1070.001](https://attack.mitre.org/techniques/T1070.001/), [T1071.001](https://attack.mitre.org/techniques/T1071.001/), [T1218.003](https://attack.mitre.org/techniques/T1218.003/), [T1485](https://attack.mitre.org/techniques/T1485/), [T1490](https://attack.mitre.org/techniques/T1490/), [T1547.001](https://attack.mitre.org/techniques/T1547.001/)
 - **Last Updated**: 2020-02-04

 <details>
@@ -4865,12 +5013,18 @@ Leverage searches that allow you to detect and investigate unusual activities th

 * [BCDEdit Failure Recovery Modification](detections.md#bcdedit-failure-recovery-modification)

+* [CMLUA Or CMSTPLUA UAC Bypass](detections.md#cmlua-or-cmstplua-uac-bypass)
+
 * [Common Ransomware Extensions](detections.md#common-ransomware-extensions)

 * [Common Ransomware Notes](detections.md#common-ransomware-notes)

 * [Deleting Shadow Copies](detections.md#deleting-shadow-copies)

+* [Detect RClone Command-Line Usage](detections.md#detect-rclone-command-line-usage)
+
+* [Detect Renamed RClone](detections.md#detect-renamed-rclone)
+
 * [Prohibited Network Traffic Allowed](detections.md#prohibited-network-traffic-allowed)

 * [Registry Keys Used For Persistence](detections.md#registry-keys-used-for-persistence)
@@ -4915,7 +5069,9 @@ Leverage searches that allow you to detect and investigate unusual activities th
 | ID          | Technique   | Tactic       |
 | ----------- | ----------- |--------------|
 | T1490 | Inhibit System Recovery | Impact |
+| T1218.003 | CMSTP | Defense Evasion |
 | T1485 | Data Destruction | Impact |
+| T1020 | Automated Exfiltration | Exfiltration |
 | T1482 | Domain Trust Discovery | Discovery |
 | T1048 | Exfiltration Over Alternative Protocol | Exfiltration |
 | T1547.001 | Registry Run Keys / Startup Folder | Persistence, Privilege Escalation |
@@ -4940,6 +5096,8 @@ Leverage searches that allow you to detect and investigate unusual activities th

 * Delivery

+* Exfiltration
+
 * Exploitation

 * Privilege Escalation
@@ -5049,7 +5207,9 @@ Leverage searches that allow you to detect and investigate unusual activities th
 | ID          | Technique   | Tactic       |
 | ----------- | ----------- |--------------|
 | T1490 | Inhibit System Recovery | Impact |
+| T1218.003 | CMSTP | Defense Evasion |
 | T1485 | Data Destruction | Impact |
+| T1020 | Automated Exfiltration | Exfiltration |
 | T1482 | Domain Trust Discovery | Discovery |
 | T1048 | Exfiltration Over Alternative Protocol | Exfiltration |
 | T1547.001 | Registry Run Keys / Startup Folder | Persistence, Privilege Escalation |
@@ -5169,6 +5329,84 @@ Leverage searches that allow you to detect and investigate unusual activities th
 * https://thehackernews.com/2018/07/samsam-ransomware-attacks.html


+_version_: 1
+</details>
+
+---
+
+### Trickbot
+Leverage searches that allow you to detect and investigate unusual activities that might relate to the trickbot banking trojan, including looking for file writes associated with its payload, process injection, shellcode execution and data collection even in LDAP environment.
+
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: Endpoint
+- **ATT&CK**: [T1021.002](https://attack.mitre.org/techniques/T1021.002/), [T1027](https://attack.mitre.org/techniques/T1027/), [T1053](https://attack.mitre.org/techniques/T1053/), [T1055](https://attack.mitre.org/techniques/T1055/), [T1059](https://attack.mitre.org/techniques/T1059/), [T1087.002](https://attack.mitre.org/techniques/T1087.002/), [T1218.011](https://attack.mitre.org/techniques/T1218.011/), [T1562.001](https://attack.mitre.org/techniques/T1562.001/), [T1566.001](https://attack.mitre.org/techniques/T1566.001/), [T1590.005](https://attack.mitre.org/techniques/T1590.005/)
+- **Last Updated**: 2021-04-20
+
+<details>
+  <summary>details</summary>
+
+#### Detection Profile
+
+* [Account Discovery With Net App](detections.md#account-discovery-with-net-app)
+
+* [Attempt To Stop Security Service](detections.md#attempt-to-stop-security-service)
+
+* [Cobalt Strike Named Pipes](detections.md#cobalt-strike-named-pipes)
+
+* [Office Application Spawn rundll32 process](detections.md#office-application-spawn-rundll32-process)
+
+* [Office Document Executing Macro Code](detections.md#office-document-executing-macro-code)
+
+* [Powershell Remote Thread To Known Windows Process](detections.md#powershell-remote-thread-to-known-windows-process)
+
+* [Schedule Task with Rundll32 Command Trigger](detections.md#schedule-task-with-rundll32-command-trigger)
+
+* [Suspicious Rundll32 StartW](detections.md#suspicious-rundll32-startw)
+
+* [Trickbot Named Pipe](detections.md#trickbot-named-pipe)
+
+* [Wermgr Process Connecting To IP Check Web Services](detections.md#wermgr-process-connecting-to-ip-check-web-services)
+
+* [Wermgr Process Create Executable File](detections.md#wermgr-process-create-executable-file)
+
+* [Wermgr Process Spawned CMD Or Powershell Process](detections.md#wermgr-process-spawned-cmd-or-powershell-process)
+
+* [Write Executable in SMB Share](detections.md#write-executable-in-smb-share)
+
+
+#### ATT&CK
+
+| ID          | Technique   | Tactic       |
+| ----------- | ----------- |--------------|
+| T1087.002 | Domain Account | Discovery |
+| T1562.001 | Disable or Modify Tools | Defense Evasion |
+| T1055 | Process Injection | Defense Evasion, Privilege Escalation |
+| T1566.001 | Spearphishing Attachment | Initial Access |
+| T1053 | Scheduled Task/Job | Execution, Persistence, Privilege Escalation |
+| T1218.011 | Rundll32 | Defense Evasion |
+| T1590.005 | IP Addresses | Reconnaissance |
+| T1027 | Obfuscated Files or Information | Defense Evasion |
+| T1059 | Command and Scripting Interpreter | Execution |
+| T1021.002 | SMB/Windows Admin Shares | Lateral Movement |
+
+#### Kill Chain Phase
+
+* Actions on Objectives
+
+* Exploitation
+
+* Installation
+
+* Lateral Movement
+
+
+#### Reference
+
+* https://en.wikipedia.org/wiki/Trickbot
+
+* https://blog.checkpoint.com/2021/03/11/february-2021s-most-wanted-malware-trickbot-takes-over-following-emotet-shutdown/
+
+
 _version_: 1
 </details>

@@ -346,6 +346,69 @@ Monitor your environment for activity consistent with common attack techniques b
 ==Adversary Tactics==


+===Active directory password spraying===
+Monitor for activities and techniques associated with Password Spraying attacks within Active Directory environments.
+
+* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+* '''Datamodel''': Endpoint
+* '''ATT&CK''': [https://attack.mitre.org/techniques/T1110.003/ T1110.003]
+* '''Last Updated''': 2021-04-07
+
+<div class="toccolours mw-collapsible mw-collapsed">
+<div class="mw-collapsible-content">
+
+====Detection Profile====
+
+* [[Documentation:ESSOC:detections:Detections#Multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos|Multiple Disabled Users Failing To Authenticate From Host Using Kerberos]]
+
+* [[Documentation:ESSOC:detections:Detections#Multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos|Multiple Invalid Users Failing To Authenticate From Host Using Kerberos]]
+
+* [[Documentation:ESSOC:detections:Detections#Multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm|Multiple Invalid Users Failing To Authenticate From Host Using NTLM]]
+
+* [[Documentation:ESSOC:detections:Detections#Multiple_users_attempting_to_authenticate_using_explicit_credentials|Multiple Users Attempting To Authenticate Using Explicit Credentials]]
+
+* [[Documentation:ESSOC:detections:Detections#Multiple_users_failing_to_authenticate_from_host_using_kerberos|Multiple Users Failing To Authenticate From Host Using Kerberos]]
+
+* [[Documentation:ESSOC:detections:Detections#Multiple_users_failing_to_authenticate_from_host_using_ntlm|Multiple Users Failing To Authenticate From Host Using NTLM]]
+
+* [[Documentation:ESSOC:detections:Detections#Multiple_users_failing_to_authenticate_from_process|Multiple Users Failing To Authenticate From Process]]
+
+* [[Documentation:ESSOC:detections:Detections#Multiple_users_remotely_failing_to_authenticate_from_host|Multiple Users Remotely Failing To Authenticate From Host]]
+
+
+
+====ATT&CK====
+{|
+! style="text-align:left;"| ID
+! Technique
+! Tactic
+|-
+| T1110.003
+| Password Spraying
+| Credential Access
+|}
+
+
+====Kill Chain Phase====
+
+* Exploitation
+
+
+====Reference====
+
+* https://attack.mitre.org/techniques/T1110/003/
+
+* https://www.microsoft.com/security/blog/2020/04/23/protecting-organization-password-spray-attacks/
+
+* https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn452415(v=ws.11)
+
+
+''version'': 1
+</div>
+</div>
+
+----
+
 ===Bits jobs===
 Adversaries may abuse BITS jobs to persistently execute or clean up after malicious payloads.

@@ -897,6 +960,8 @@ Uncover activity consistent with credential dumping, a technique wherein attacke

 * [[Documentation:ESSOC:detections:Detections#Dump_lsass_via_procdump_rename|Dump LSASS via procdump Rename]]

+* [[Documentation:ESSOC:detections:Detections#Extract_sam_from_registry|Extract SAM from Registry]]
+
 * [[Documentation:ESSOC:detections:Detections#Ntdsutil_export_ntds|Ntdsutil Export NTDS]]

 * [[Documentation:ESSOC:detections:Detections#Set_default_powershell_execution_policy_to_unrestricted_or_bypass|Set Default PowerShell Execution Policy To Unrestricted or Bypass]]
@@ -1001,6 +1066,8 @@ Uncover activity consistent with credential dumping, a technique wherein attacke

 * Actions on Objectives

+* Exploitation
+
 * Installation


@@ -3376,6 +3443,10 @@ Detect tactics used by malware to evade defenses on Windows endpoints. A few of

 * [[Documentation:ESSOC:detections:Detections#Remote_registry_key_modifications|Remote Registry Key modifications]]

+* [[Documentation:ESSOC:detections:Detections#Slui_runas_elevated|SLUI RunAs Elevated]]
+
+* [[Documentation:ESSOC:detections:Detections#Slui_spawning_a_process|SLUI Spawning a Process]]
+
 * [[Documentation:ESSOC:detections:Detections#Suspicious_reg_exe_process|Suspicious Reg exe Process]]

 * [[Documentation:ESSOC:detections:Detections#System_process_running_from_unexpected_location|System Process Running from Unexpected Location]]
@@ -3741,6 +3812,10 @@ Monitor for activities and techniques associated with maintaining persistence on

 * [[Documentation:ESSOC:detections:Detections#Sc_exe_manipulating_windows_services|Sc exe Manipulating Windows Services]]

+* [[Documentation:ESSOC:detections:Detections#Schedule_task_with_http_command_arguments|Schedule Task with HTTP Command Arguments]]
+
+* [[Documentation:ESSOC:detections:Detections#Schedule_task_with_rundll32_command_trigger|Schedule Task with Rundll32 Command Trigger]]
+
 * [[Documentation:ESSOC:detections:Detections#Schtasks_used_for_forcing_a_reboot|Schtasks used for forcing a reboot]]

 * [[Documentation:ESSOC:detections:Detections#Setting_credentials_via_dsinternals_modules|Setting Credentials via DSInternals modules]]
@@ -3749,8 +3824,6 @@ Monitor for activities and techniques associated with maintaining persistence on

 * [[Documentation:ESSOC:detections:Detections#Setting_credentials_via_powersploit_modules|Setting Credentials via PowerSploit modules]]

-* [[Documentation:ESSOC:detections:Detections#Shedule_task_with_http_command_arguments|Shedule Task with HTTP Command Arguments]]
-
 * [[Documentation:ESSOC:detections:Detections#Shim_database_file_creation|Shim Database File Creation]]

 * [[Documentation:ESSOC:detections:Detections#Shim_database_installation_with_suspicious_parameters|Shim Database Installation With Suspicious Parameters]]
@@ -5986,6 +6059,127 @@ Monitor for suspicious activities associated with DHS Technical Alert US-CERT TA

 ----

+===Darkside ransomware===
+Leverage searches that allow you to detect and investigate unusual activities that might relate to the DarkSide Ransomware
+
+* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+* '''Datamodel''': Endpoint
+* '''ATT&CK''': [https://attack.mitre.org/techniques/T1003.002/ T1003.002], [https://attack.mitre.org/techniques/T1197/ T1197], [https://attack.mitre.org/techniques/T1105/ T1105], [https://attack.mitre.org/techniques/T1218.003/ T1218.003], [https://attack.mitre.org/techniques/T1055/ T1055], [https://attack.mitre.org/techniques/T1490/ T1490], [https://attack.mitre.org/techniques/T1003.001/ T1003.001], [https://attack.mitre.org/techniques/T1021.002/ T1021.002], [https://attack.mitre.org/techniques/T1020/ T1020], [https://attack.mitre.org/techniques/T1486/ T1486], [https://attack.mitre.org/techniques/T1548.002/ T1548.002]
+* '''Last Updated''': 2020-06-12
+
+<div class="toccolours mw-collapsible mw-collapsed">
+<div class="mw-collapsible-content">
+
+====Detection Profile====
+
+* [[Documentation:ESSOC:detections:Detections#Attempted_credential_dump_from_registry_via_reg_exe|Attempted Credential Dump From Registry via Reg exe]]
+
+* [[Documentation:ESSOC:detections:Detections#Bitsadmin_download_file|BITSAdmin Download File]]
+
+* [[Documentation:ESSOC:detections:Detections#Cmlua_or_cmstplua_uac_bypass|CMLUA Or CMSTPLUA UAC Bypass]]
+
+* [[Documentation:ESSOC:detections:Detections#Certutil_download_with_urlcache_and_split_arguments|CertUtil Download With URLCache and Split Arguments]]
+
+* [[Documentation:ESSOC:detections:Detections#Certutil_download_with_verifyctl_and_split_arguments|CertUtil Download With VerifyCtl and Split Arguments]]
+
+* [[Documentation:ESSOC:detections:Detections#Cobalt_strike_named_pipes|Cobalt Strike Named Pipes]]
+
+* [[Documentation:ESSOC:detections:Detections#Delete_shadowcopy_with_powershell|Delete ShadowCopy With PowerShell]]
+
+* [[Documentation:ESSOC:detections:Detections#Detect_mimikatz_using_loaded_images|Detect Mimikatz Using Loaded Images]]
+
+* [[Documentation:ESSOC:detections:Detections#Detect_psexec_with_accepteula_flag|Detect PsExec With accepteula Flag]]
+
+* [[Documentation:ESSOC:detections:Detections#Detect_rclone_command-line_usage|Detect RClone Command-Line Usage]]
+
+* [[Documentation:ESSOC:detections:Detections#Detect_renamed_rclone|Detect Renamed RClone]]
+
+* [[Documentation:ESSOC:detections:Detections#Extract_sam_from_registry|Extract SAM from Registry]]
+
+* [[Documentation:ESSOC:detections:Detections#Ransomware_notes_bulk_creation|Ransomware Notes bulk creation]]
+
+* [[Documentation:ESSOC:detections:Detections#Slui_runas_elevated|SLUI RunAs Elevated]]
+
+* [[Documentation:ESSOC:detections:Detections#Slui_spawning_a_process|SLUI Spawning a Process]]
+
+
+
+====ATT&CK====
+{|
+! style="text-align:left;"| ID
+! Technique
+! Tactic
+|-
+| T1003.002
+| Security Account Manager
+| Credential Access
+|-
+| T1197
+| BITS Jobs
+| Defense Evasion, Persistence
+|-
+| T1105
+| Ingress Tool Transfer
+| Command and Control
+|-
+| T1218.003
+| CMSTP
+| Defense Evasion
+|-
+| T1055
+| Process Injection
+| Defense Evasion, Privilege Escalation
+|-
+| T1490
+| Inhibit System Recovery
+| Impact
+|-
+| T1003.001
+| LSASS Memory
+| Credential Access
+|-
+| T1021.002
+| SMB/Windows Admin Shares
+| Lateral Movement
+|-
+| T1020
+| Automated Exfiltration
+| Exfiltration
+|-
+| T1486
+| Data Encrypted for Impact
+| Impact
+|-
+| T1548.002
+| Bypass User Account Control
+| Defense Evasion, Privilege Escalation
+|}
+
+
+====Kill Chain Phase====
+
+* Actions on Objectives
+
+* Exfiltration
+
+* Exploitation
+
+* Obfuscation
+
+
+====Reference====
+
+* https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/
+
+* https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html
+
+
+''version'': 1
+</div>
+</div>
+
+----
+
 ===Dynamic dns===
 Detect and investigate hosts in your environment that may be communicating with dynamic domain providers. Attackers may leverage these services to help them avoid firewall blocks and deny lists.

@@ -6327,7 +6521,7 @@ Leverage searches that allow you to detect and investigate unusual activities th

 * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 * '''Datamodel''': Endpoint, Network_Traffic
-* '''ATT&CK''': [https://attack.mitre.org/techniques/T1490/ T1490], [https://attack.mitre.org/techniques/T1485/ T1485], [https://attack.mitre.org/techniques/T1482/ T1482], [https://attack.mitre.org/techniques/T1048/ T1048], [https://attack.mitre.org/techniques/T1547.001/ T1547.001], [https://attack.mitre.org/techniques/T1021.001/ T1021.001], [https://attack.mitre.org/techniques/T1047/ T1047], [https://attack.mitre.org/techniques/T1486/ T1486], [https://attack.mitre.org/techniques/T1059.003/ T1059.003], [https://attack.mitre.org/techniques/T1021.002/ T1021.002], [https://attack.mitre.org/techniques/T1053.005/ T1053.005], [https://attack.mitre.org/techniques/T1070.001/ T1070.001], [https://attack.mitre.org/techniques/T1036.003/ T1036.003], [https://attack.mitre.org/techniques/T1071.001/ T1071.001], [https://attack.mitre.org/techniques/T1070/ T1070], [https://attack.mitre.org/techniques/T1562.001/ T1562.001], [https://attack.mitre.org/techniques/T1489/ T1489]
+* '''ATT&CK''': [https://attack.mitre.org/techniques/T1490/ T1490], [https://attack.mitre.org/techniques/T1218.003/ T1218.003], [https://attack.mitre.org/techniques/T1485/ T1485], [https://attack.mitre.org/techniques/T1020/ T1020], [https://attack.mitre.org/techniques/T1482/ T1482], [https://attack.mitre.org/techniques/T1048/ T1048], [https://attack.mitre.org/techniques/T1547.001/ T1547.001], [https://attack.mitre.org/techniques/T1021.001/ T1021.001], [https://attack.mitre.org/techniques/T1047/ T1047], [https://attack.mitre.org/techniques/T1486/ T1486], [https://attack.mitre.org/techniques/T1059.003/ T1059.003], [https://attack.mitre.org/techniques/T1021.002/ T1021.002], [https://attack.mitre.org/techniques/T1053.005/ T1053.005], [https://attack.mitre.org/techniques/T1070.001/ T1070.001], [https://attack.mitre.org/techniques/T1036.003/ T1036.003], [https://attack.mitre.org/techniques/T1071.001/ T1071.001], [https://attack.mitre.org/techniques/T1070/ T1070], [https://attack.mitre.org/techniques/T1562.001/ T1562.001], [https://attack.mitre.org/techniques/T1489/ T1489]
 * '''Last Updated''': 2020-02-04

 <div class="toccolours mw-collapsible mw-collapsed">
@@ -6337,12 +6531,18 @@ Leverage searches that allow you to detect and investigate unusual activities th

 * [[Documentation:ESSOC:detections:Detections#Bcdedit_failure_recovery_modification|BCDEdit Failure Recovery Modification]]

+* [[Documentation:ESSOC:detections:Detections#Cmlua_or_cmstplua_uac_bypass|CMLUA Or CMSTPLUA UAC Bypass]]
+
 * [[Documentation:ESSOC:detections:Detections#Common_ransomware_extensions|Common Ransomware Extensions]]

 * [[Documentation:ESSOC:detections:Detections#Common_ransomware_notes|Common Ransomware Notes]]

 * [[Documentation:ESSOC:detections:Detections#Deleting_shadow_copies|Deleting Shadow Copies]]

+* [[Documentation:ESSOC:detections:Detections#Detect_rclone_command-line_usage|Detect RClone Command-Line Usage]]
+
+* [[Documentation:ESSOC:detections:Detections#Detect_renamed_rclone|Detect Renamed RClone]]
+
 * [[Documentation:ESSOC:detections:Detections#Prohibited_network_traffic_allowed|Prohibited Network Traffic Allowed]]

 * [[Documentation:ESSOC:detections:Detections#Registry_keys_used_for_persistence|Registry Keys Used For Persistence]]
@@ -6393,10 +6593,18 @@ Leverage searches that allow you to detect and investigate unusual activities th
 | Inhibit System Recovery
 | Impact
 |-
+| T1218.003
+| CMSTP
+| Defense Evasion
+|-
 | T1485
 | Data Destruction
 | Impact
 |-
+| T1020
+| Automated Exfiltration
+| Exfiltration
+|-
 | T1482
 | Domain Trust Discovery
 | Discovery
@@ -6467,6 +6675,8 @@ Leverage searches that allow you to detect and investigate unusual activities th

 * Delivery

+* Exfiltration
+
 * Exploitation

 * Privilege Escalation
@@ -6539,7 +6749,7 @@ Leverage searches that allow you to detect and investigate unusual activities th

 * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 * '''Datamodel''': Endpoint, Network_Traffic
-* '''ATT&CK''': [https://attack.mitre.org/techniques/T1490/ T1490], [https://attack.mitre.org/techniques/T1485/ T1485], [https://attack.mitre.org/techniques/T1482/ T1482], [https://attack.mitre.org/techniques/T1048/ T1048], [https://attack.mitre.org/techniques/T1547.001/ T1547.001], [https://attack.mitre.org/techniques/T1021.001/ T1021.001], [https://attack.mitre.org/techniques/T1047/ T1047], [https://attack.mitre.org/techniques/T1486/ T1486], [https://attack.mitre.org/techniques/T1059.003/ T1059.003], [https://attack.mitre.org/techniques/T1021.002/ T1021.002], [https://attack.mitre.org/techniques/T1053.005/ T1053.005], [https://attack.mitre.org/techniques/T1070.001/ T1070.001], [https://attack.mitre.org/techniques/T1036.003/ T1036.003], [https://attack.mitre.org/techniques/T1071.001/ T1071.001], [https://attack.mitre.org/techniques/T1070/ T1070], [https://attack.mitre.org/techniques/T1562.001/ T1562.001], [https://attack.mitre.org/techniques/T1489/ T1489]
+* '''ATT&CK''': [https://attack.mitre.org/techniques/T1490/ T1490], [https://attack.mitre.org/techniques/T1218.003/ T1218.003], [https://attack.mitre.org/techniques/T1485/ T1485], [https://attack.mitre.org/techniques/T1020/ T1020], [https://attack.mitre.org/techniques/T1482/ T1482], [https://attack.mitre.org/techniques/T1048/ T1048], [https://attack.mitre.org/techniques/T1547.001/ T1547.001], [https://attack.mitre.org/techniques/T1021.001/ T1021.001], [https://attack.mitre.org/techniques/T1047/ T1047], [https://attack.mitre.org/techniques/T1486/ T1486], [https://attack.mitre.org/techniques/T1059.003/ T1059.003], [https://attack.mitre.org/techniques/T1021.002/ T1021.002], [https://attack.mitre.org/techniques/T1053.005/ T1053.005], [https://attack.mitre.org/techniques/T1070.001/ T1070.001], [https://attack.mitre.org/techniques/T1036.003/ T1036.003], [https://attack.mitre.org/techniques/T1071.001/ T1071.001], [https://attack.mitre.org/techniques/T1070/ T1070], [https://attack.mitre.org/techniques/T1562.001/ T1562.001], [https://attack.mitre.org/techniques/T1489/ T1489]
 * '''Last Updated''': 2020-11-06

 <div class="toccolours mw-collapsible mw-collapsed">
@@ -6591,10 +6801,18 @@ Leverage searches that allow you to detect and investigate unusual activities th
 | Inhibit System Recovery
 | Impact
 |-
+| T1218.003
+| CMSTP
+| Defense Evasion
+|-
 | T1485
 | Data Destruction
 | Impact
 |-
+| T1020
+| Automated Exfiltration
+| Exfiltration
+|-
 | T1482
 | Domain Trust Discovery
 | Discovery
@@ -6786,6 +7004,119 @@ Leverage searches that allow you to detect and investigate unusual activities th
 * https://thehackernews.com/2018/07/samsam-ransomware-attacks.html


+''version'': 1
+</div>
+</div>
+
+----
+
+===Trickbot===
+Leverage searches that allow you to detect and investigate unusual activities that might relate to the trickbot banking trojan, including looking for file writes associated with its payload, process injection, shellcode execution and data collection even in LDAP environment.
+
+* '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+* '''Datamodel''': Endpoint
+* '''ATT&CK''': [https://attack.mitre.org/techniques/T1087.002/ T1087.002], [https://attack.mitre.org/techniques/T1562.001/ T1562.001], [https://attack.mitre.org/techniques/T1055/ T1055], [https://attack.mitre.org/techniques/T1566.001/ T1566.001], [https://attack.mitre.org/techniques/T1053/ T1053], [https://attack.mitre.org/techniques/T1218.011/ T1218.011], [https://attack.mitre.org/techniques/T1590.005/ T1590.005], [https://attack.mitre.org/techniques/T1027/ T1027], [https://attack.mitre.org/techniques/T1059/ T1059], [https://attack.mitre.org/techniques/T1021.002/ T1021.002]
+* '''Last Updated''': 2021-04-20
+
+<div class="toccolours mw-collapsible mw-collapsed">
+<div class="mw-collapsible-content">
+
+====Detection Profile====
+
+* [[Documentation:ESSOC:detections:Detections#Account_discovery_with_net_app|Account Discovery With Net App]]
+
+* [[Documentation:ESSOC:detections:Detections#Attempt_to_stop_security_service|Attempt To Stop Security Service]]
+
+* [[Documentation:ESSOC:detections:Detections#Cobalt_strike_named_pipes|Cobalt Strike Named Pipes]]
+
+* [[Documentation:ESSOC:detections:Detections#Office_application_spawn_rundll32_process|Office Application Spawn rundll32 process]]
+
+* [[Documentation:ESSOC:detections:Detections#Office_document_executing_macro_code|Office Document Executing Macro Code]]
+
+* [[Documentation:ESSOC:detections:Detections#Powershell_remote_thread_to_known_windows_process|Powershell Remote Thread To Known Windows Process]]
+
+* [[Documentation:ESSOC:detections:Detections#Schedule_task_with_rundll32_command_trigger|Schedule Task with Rundll32 Command Trigger]]
+
+* [[Documentation:ESSOC:detections:Detections#Suspicious_rundll32_startw|Suspicious Rundll32 StartW]]
+
+* [[Documentation:ESSOC:detections:Detections#Trickbot_named_pipe|Trickbot Named Pipe]]
+
+* [[Documentation:ESSOC:detections:Detections#Wermgr_process_connecting_to_ip_check_web_services|Wermgr Process Connecting To IP Check Web Services]]
+
+* [[Documentation:ESSOC:detections:Detections#Wermgr_process_create_executable_file|Wermgr Process Create Executable File]]
+
+* [[Documentation:ESSOC:detections:Detections#Wermgr_process_spawned_cmd_or_powershell_process|Wermgr Process Spawned CMD Or Powershell Process]]
+
+* [[Documentation:ESSOC:detections:Detections#Write_executable_in_smb_share|Write Executable in SMB Share]]
+
+
+
+====ATT&CK====
+{|
+! style="text-align:left;"| ID
+! Technique
+! Tactic
+|-
+| T1087.002
+| Domain Account
+| Discovery
+|-
+| T1562.001
+| Disable or Modify Tools
+| Defense Evasion
+|-
+| T1055
+| Process Injection
+| Defense Evasion, Privilege Escalation
+|-
+| T1566.001
+| Spearphishing Attachment
+| Initial Access
+|-
+| T1053
+| Scheduled Task/Job
+| Execution, Persistence, Privilege Escalation
+|-
+| T1218.011
+| Rundll32
+| Defense Evasion
+|-
+| T1590.005
+| IP Addresses
+| Reconnaissance
+|-
+| T1027
+| Obfuscated Files or Information
+| Defense Evasion
+|-
+| T1059
+| Command and Scripting Interpreter
+| Execution
+|-
+| T1021.002
+| SMB/Windows Admin Shares
+| Lateral Movement
+|}
+
+
+====Kill Chain Phase====
+
+* Actions on Objectives
+
+* Exploitation
+
+* Installation
+
+* Lateral Movement
+
+
+====Reference====
+
+* https://en.wikipedia.org/wiki/Trickbot
+
+* https://blog.checkpoint.com/2021/03/11/february-2021s-most-wanted-malware-trickbot-takes-over-following-emotet-shutdown/
+
+
 ''version'': 1
 </div>
 </div>
@@ -7290,7 +7621,7 @@ Reduce the risk of CVE-2018-11409, an information disclosure vulnerability withi
 <pre>
 #############
 # Automatically generated by doc_gen.py in https://github.com/splunk/security_content
-# On Date: 2021-04-29 21:24:37.285211 UTC
+# On Date: 2021-05-13 22:00:22.199260 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############