Branch was auto-updated.

bin/jinja2_templates/doc_detections.j2

@@ -31,7 +31,7 @@ tags:
 
 {% if detection.experimental is sameas true -%}
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 {% endif %}
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

detections/endpoint/detect_exchange_web_shell.yml

@@ -67,6 +67,7 @@ tags:
   mitre_attack_id:
   - T1505
   - T1505.003
+  - T1190
   observable:
   - name: user
     type: User

detections/endpoint/loading_of_dynwrapx_module.yml

@@ -8,18 +8,19 @@ datamodel:
 - Endpoint
 description: DynamicWrapperX is an ActiveX component that can be used in a script
   to call Windows API functions, but it requires the dynwrapx.dll to be installed
-  and registered. With that, registering or loading dynwrapx.dll to a host highly
-  suspect. Why is it needed? In most malicious instances, During triage, review parallel
-  processes and pivot on the process_guid. Review the registry for any suspicious
-  modifications meant to load dynwrapx.dll. Identify any suspicious module loads of
-  dynwrapx.dll. This will identify the process that will invoke vbs/wscript/cscript.
+  and registered. With that, registering or loading dynwrapx.dll to a host is highly
+  suspicious. In most instances when it is used maliciously, the best way to triage 
+  is to review parallel processes and pivot on the process_guid. Review the registry 
+  for any suspicious modifications meant to load dynwrapx.dll. Identify any suspicious 
+  module loads of dynwrapx.dll. This detection will return and identify the processes 
+  that invoke vbs/wscript/cscript.
 search: '`sysmon` EventCode=7 (ImageLoaded = "*\\dynwrapx.dll" OR OriginalFileName
   = "dynwrapx.dll" OR  Product = "DynamicWrapperX") | stats count min(_time) as firstTime
   max(_time) as lastTime by Image ImageLoaded OriginalFileName Product process_name
   Computer EventCode Signed ProcessId | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `loading_of_dynwrapx_module_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
+  on processes that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem`
   node. In addition, confirm the latest CIM App 4.20 or higher is installed and the
   latest TA for the endpoint product.

detections/endpoint/msi_module_loaded_by_non_system_binary.yml

@@ -0,0 +1,79 @@
+name: MSI Module Loaded by Non-System Binary
+id: ccb98a66-5851-11ec-b91c-acde48001122
+version: 1
+date: '2021-12-08'
+author: Michael Haag, Splunk
+type: Hunting
+datamodel: []
+description: 'The following hunting analytic identifies `msi.dll` being loaded by a binary not located in `system32`, `syswow64`, `winsxs` or `windows` paths. This behavior is most recently related to InstallerFileTakeOver, or CVE-2021-41379, and DLL side-loading. 
+  CVE-2021-41379 requires a binary to be dropped and `msi.dll` to be loaded by it. To Successful exploitation of this issue happens in four parts \
+
+  1. Generation of an MSI that will trigger bad behavior. \
+
+  1. Preparing a directory for MSI installation. \
+
+  1. Inducing an error state. \
+
+  1. Racing to introduce a junction and a symlink to trick msiexec.exe to modify the attacker specified file. \
+  
+  In addition, `msi.dll` has been abused in DLL side-loading attacks by being loaded by non-system binaries.'
+search: '`sysmon` EventCode=7 ImageLoaded="*\\msi.dll" NOT (Image IN ("*\\System32\\*","*\\syswow64\\*","*\\windows\\*", "*\\winsxs\\*")) 
+  | stats count min(_time) as firstTime max(_time) as lastTime
+      by Image ImageLoaded process_name Computer EventCode ProcessId 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `msi_module_loaded_by_non_system_binary_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name and imageloaded executions from your endpoints. If you
+  are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+known_false_positives: It is possible some Administrative utilities will load msi.dll outside of normal system paths, filter as needed.
+references:
+  - https://attackerkb.com/topics/7LstI2clmF/cve-2021-41379/rapid7-analysis 
+  - https://github.com/klinix5/InstallerFileTakeOver
+  - https://github.com/mandiant/red_team_tool_countermeasures/blob/master/rules/PGF/supplemental/hxioc/msi.dll%20Hijack%20(Methodology).ioc
+cve:
+  - CVE-2021-41379
+tags:
+  analytic_story:
+  - Windows Privilege Escalation
+  dataset: []
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1574.002
+  - T1574
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Image 
+  - ImageLoaded
+  - process_name 
+  - Computer
+  - EventCode 
+  - ProcessId 
+  security_domain: endpoint
+  impact: 80
+  confidence: 70
+  # (impact * confidence)/100
+  risk_score: 56
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: The following module $ImageLoaded$ was loaded by $Image$ outside of the normal system paths on endpoint $Computer$, potentally related to DLL side-loading.
+  observable:
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  - name: ImageLoaded
+    type: Other
+    role:
+    - Other
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  

detections/endpoint/possible_browser_pass_view_parameter.yml

@@ -6,15 +6,13 @@ author: Teoderick Contreras, Splunk
 type: Hunting
 datamodel:
 - Endpoint
-description: This analytic will detect a suspicious process contains a commandline
-  parameter related to web browser credential dumper. This technique was used by Remcos
-  RAT malware where it use the techique of Nirsoft webbrowserpassview.exe application
-  to dump web browser credentials. Remcos use the "/stext" commandline to dump the
-  credential in text format. This Hunting query is good indicator to look further
-  for possible remcos infection within the network or possible compromised host. Since
-  the detections is only base on the parameter command and the possible path where
-  it will drop the text credential information, It may catch normal tools that having
-  same command and behavior.
+description: This analytic will detect if a suspicious process contains a commandline
+  parameter related to a web browser credential dumper. This technique is used by Remcos RAT 
+  malware which uses the Nirsoft webbrowserpassview.exe application to dump web browser 
+  credentials. Remcos uses the "/stext" command line to dump the credentials in text format. 
+  This Hunting query is a good indicator of hosts suffering from possible Remcos RAT infection. 
+  Since the hunting query is based on the parameter command and the possible path where it will 
+  save the text credential information, it may catch normal tools that are using the same command and behavior.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process  IN ("*/stext
   *", "*/shtml *", "*/LoadPasswordsIE*", "*/LoadPasswordsFirefox*", "*/LoadPasswordsChrome*",

detections/endpoint/resize_shadowstorage_volume.yml

@@ -28,8 +28,11 @@ how_to_implement: To successfully implement this search, you need to be ingestin
   Sysmon TA.
 known_false_positives: network admin can resize the shadowstorage for valid purposes.
 references:
-- https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html
-- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html
+  - https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html
+  - https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md
+  - https://redcanary.com/blog/blackbyte-ransomware/
+  - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/vssadmin-resize-shadowstorage
 tags:
   analytic_story:
   - Clop Ransomware

detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml

@@ -6,24 +6,22 @@ author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This analytic is to detect a suspicious process having a dns query on
-  known abuse text paste web services, or VoIP, instant messaging and digital distribution
-  platform to download some files. This technique is abused by adversaries, malware
-  attacker and red team to download a malicious file on the target host. This is a
-  good TTP indicator for possible initial access technique. Noise and false positive
-  can be seen if the following instant messaging is allowed or common application
-  in corporate network.
+description: This analytic detects a suspicious process making a DNS query via known, abused 
+  text-paste web services, VoIP, instant messaging, and digital distribution platforms used 
+  to download external files. This technique is abused by adversaries, malware actors, and 
+  red teams to download a malicious file on the target host. This is a good TTP indicator 
+  for possible initial access techniques. A user will experience false positives if the 
+  following instant messaging is allowed or common applications like telegram or discord 
+  are allowed in the corporate network.
 search: '`sysmon` EventCode=22 QueryName IN ("*pastebin*", "*discord*", "*telegram*",
   "*t.me*") process_name IN ("cmd.exe", "*powershell*", "pwsh.exe", "wscript.exe",
   "cscript.exe") | stats count min(_time) as firstTime max(_time) as lastTime by Image
   QueryName QueryStatus process_name QueryResults Computer | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `suspicious_process_dns_query_known_abuse_web_services_filter`'
-how_to_implement: his detection relies on sysmon logs with the Event ID 7, Driver
-  loaded. Please tune your sysmon config that you DriverLoad event for SolarWinds.Orion.Core.BusinessLayer.dll
-  is captured by Sysmon. Additionally, you need sysmon logs for Event ID 22, DNS Query.
-  We suggest to run this detection at least once a day over the last 14 days.
+how_to_implement: This detection relies on sysmon logs with the Event ID 22, 
+  DNS Query. We suggest you run this detection at least once a day over the last 14 days.
 known_false_positives: Noise and false positive can be seen if the following instant
-  messaging is allowed to use within corporate network. filter is needed.
+  messaging is allowed to use within corporate network. In this case, a filter is needed.
 references:
 - https://urlhaus.abuse.ch/url/1798923/
 tags:

detections/endpoint/system_info_gathering_using_dxdiag_application.yml

@@ -6,12 +6,16 @@ author: Teoderick Contreras, Splunk
 type: Hunting
 datamodel:
 - Endpoint
-description: This analytic is to detect a suspicious dxdiag.exe process commandline
-  can collect system info of the target host. This technique was seen in remcos, adversaries
-  and other malware to collect information as part of recon or collection phase of
-  attack. Even this behavior is rarely seen in a corporate network this commandline
-  can be used by network administrator to audit host machine specification. Better
-  to check what it did after it pipes out the result to a file for further processing.
+description: This analytic is to detect a suspicious dxdiag.exe process 
+  command-line execution. Dxdiag is used to collect the system info of 
+  the target host. This technique has been used by Remcos RATS, various 
+  actors, and other malware to collect information as part of the recon 
+  or collection phase of an attack. This behavior should rarely be seen 
+  in a corporate network, but this command line can be used by a network 
+  administrator to audit host machine specifications. Thus in some rare 
+  cases, this detection will contain false positives in its results. To 
+  triage further, analyze what commands were passed after it pipes out 
+  the result to a file for further processing.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_dxdiag` AND Processes.process
   = "* /t *" by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process
@@ -23,8 +27,8 @@ how_to_implement: To successfully implement this search you need to be ingesting
   your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem`
   node. In addition, confirm the latest CIM App 4.20 or higher is installed and the
   latest TA for the endpoint product.
-known_false_positives: this commandline can be used by network administrator to audit
-  host machine specification.filter is needed.
+known_false_positives: This commandline can be used by a network administrator to audit
+  host machine specifications. Thus, a filter is needed.
 references:
 - https://app.any.run/tasks/df0baf9f-8baf-4c32-a452-16562ecb19be/
 tags:

detections/endpoint/windows_dism_remove_defender.yml

@@ -0,0 +1,81 @@
+name: Windows DISM Remove Defender
+id: 8567da9e-47f0-11ec-99a9-acde48001122
+version: 1
+date: '2021-11-17'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies the use of the Windows Disk Image Utility,
+  `dism.exe`, to remove Windows Defender. Adversaries may use `dism.exe` to disable
+  Defender before completing their objective.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=dism.exe
+  (Processes.process="*/online*" AND Processes.process="*/disable-feature*" AND Processes.process="*Windows-Defender*"
+  AND Processes.process="*/remove*") by Processes.dest Processes.user Processes.parent_process_name
+  Processes.process_name Processes.original_file_name Processes.process Processes.process_id
+  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `windows_dism_remove_defender_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: Some legitimate administrative tools leverage `dism.exe` to
+  manipulate packages and features of the operating system. Filter as needed.
+references:
+- https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/
+tags:
+  analytic_story:
+  - Windows Defense Evasion Tactics
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/atomic_red_team/windows-sysmon_dism.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1562.001
+  - T1562
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: access
+  impact: 80
+  confidence: 100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ attempting to disable Windows Defender.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  automated_detection_testing: passed

detections/endpoint/windows_raccine_scheduled_task_deletion.yml

@@ -0,0 +1,81 @@
+name: Windows Raccine Scheduled Task Deletion
+id: c9f010da-57ab-11ec-82bd-acde48001122
+version: 1
+date: '2021-12-07'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies the Raccine Rules Updater scheduled
+  task being deleted. Adversaries may attempt to remove this task in order to prevent
+  the update of Raccine.  Raccine is a "ransomware vaccine" created by security researcher
+  Florian Roth, designed to intercept and prevent precursors and active ransomware
+  behavior.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=schtasks.exe
+  Processes.process="*delete*" AND Processes.process="*Raccine*" by Processes.dest
+  Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_raccine_scheduled_task_deletion_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: False positives should be limited, however filter as needed.
+references:
+- https://redcanary.com/blog/blackbyte-ransomware/
+- https://github.com/Neo23x0/Raccine
+tags:
+  analytic_story:
+  - Ransomware
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/atomic_red_team/windows-sysmon_raccine.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1562.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 80
+  confidence: 100
+  risk_score: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user user$ attempting to disable Raccines scheduled task.
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  automated_detection_testing: passed

detections/experimental/endpoint/microsoft_exchange_mailbox_replication_service_writing_active_server_pages.yml

@@ -0,0 +1,100 @@
+name: Microsoft Exchange Mailbox Replication service writing Active Server Pages
+id: 985f322c-57a5-11ec-b9ac-acde48001122
+version: 1
+date: '2021-12-07'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: 'The following query identifies suspicious .aspx created in 3 paths identified
+  by Microsoft as known drop locations for Exchange exploitation related to HAFNIUM
+  group and recently disclosed vulnerablity named ProxyShell. Paths include: `\HttpProxy\owa\auth\`,
+  `\inetpub\wwwroot\aspnet_client\`, and `\HttpProxy\OAB\`. The analytic is limited to process name MSExchangeMailboxReplication.exe, which typically does not write .aspx files to disk.
+  Upon triage, the suspicious
+  .aspx file will likely look obvious on the surface. inspect the contents for script
+  code inside. Identify additional log sources, IIS included, to review source and
+  other potential exploitation. It is often the case that a particular threat is only
+  applicable to a specific subset of systems in your environment. Typically analytics
+  to detect those threats are written without the benefit of being able to only target
+  those systems as well. Writing analytics against all systems when those behaviors
+  are limited to identifiable subsets of those systems is suboptimal. Consider the
+  case ProxyShell vulnerability on Microsoft Exchange Servers. With asset information,
+  a hunter can limit their analytics to systems that have been identified as Exchange
+  servers. A hunter may start with the theory that the exchange server is communicating
+  with new systems that it has not previously. If this theory is run against all publicly
+  facing systems, the amount of noise it will generate will likely render this theory
+  untenable. However, using the asset information to limit this analytic to just the
+  Exchange servers will reduce the noise allowing the hunter to focus only on the
+  systems where this behavioral change is relevant.'
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  where Processes.process_name=MSExchangeMailboxReplication.exe  by _time span=1h Processes.process_id Processes.process_name Processes.process_guid
+  Processes.dest | `drop_dm_object_name(Processes)` | join process_guid, _time [|
+  tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\HttpProxy\\owa\\auth\\*",
+  "*\\inetpub\\wwwroot\\aspnet_client\\*", "*\\HttpProxy\\OAB\\*") Filesystem.file_name="*.aspx"
+  by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name
+  Filesystem.file_path | `drop_dm_object_name(Filesystem)` | fields _time dest file_create_time
+  file_name file_path process_name process_path process process_guid] | dedup file_create_time
+  | table dest file_create_time, file_name, file_path, process_name | `microsoft_exchange_mailbox_replication_service_writing_active_server_pages_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem`
+  node.
+known_false_positives: The query is structured in a way that `action` (read, create)
+  is not defined. Review the results of this query, filter, and tune as necessary.
+  It may be necessary to generate this query specific to your endpoint product.
+references:
+  - https://redcanary.com/blog/blackbyte-ransomware/
+tags:
+  analytic_story:
+  - ProxyShell
+  - Ransomware
+  confidence: 90
+  context:
+  - Source:Endpoint
+  - Stage:Exploitation
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.003/windows-sysmon_proxylogon.log
+  impact: 90
+  kill_chain_phases:
+  - Exploitation
+  message: A file - $file_name$ was written to disk that is related to IIS exploitation
+    related to ProxyShell. Review further file modifications on endpoint
+    $dest$ by user $user$.
+  mitre_attack_id:
+  - T1505
+  - T1505.003
+  - T1190
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: file_name
+    type: File Name
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Filesystem.file_path
+  - Filesystem.process_id
+  - Filesystem.file_name
+  - Filesystem.file_hash
+  - Filesystem.user
+  - Filesystem.process_guid
+  - Processes.process_name
+  - Processes.process_id 
+  - Processes.process_name 
+  - Processes.process_guid
+  risk_score: 81
+  security_domain: endpoint
+
+  

docs/_data/navigation.yml

@@ -85,6 +85,8 @@ stories:
         url: /stories/cloud_security/
       - title: Malware
         url: /stories/malware/
+      - title: Privilege Escalation
+        url: /stories/privilege_escalation/
       - title: Vulnerability
         url: /stories/vulnerability/
 playbooks:

docs/_pages/detections.md

@@ -589,6 +589,7 @@ sidebar:
 | [Start Up During Safe Mode Boot](/endpoint/start_up_during_safe_mode_boot/) | [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | TTP |
 | [Sunburst Correlation DLL and Network Event](/endpoint/sunburst_correlation_dll_and_network_event/) | [Exploitation for Client Execution](/tags/#exploitation-for-client-execution) | TTP |
 | [Supernova Webshell](/web/supernova_webshell/) | [Web Shell](/tags/#web-shell) | TTP |
+| [Suspicious Computer Account Name Change](/endpoint/suspicious_computer_account_name_change/) | [Valid Accounts](/tags/#valid-accounts), [Domain Accounts](/tags/#domain-accounts) | TTP |
 | [Suspicious Copy on System32](/endpoint/suspicious_copy_on_system32/) | [Rename System Utilities](/tags/#rename-system-utilities), [Masquerading](/tags/#masquerading) | TTP |
 | [Suspicious Curl Network Connection](/endpoint/suspicious_curl_network_connection/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP |
 | [Suspicious DLLHost no Command Line Arguments](/endpoint/suspicious_dllhost_no_command_line_arguments/) | [Process Injection](/tags/#process-injection) | TTP |
@@ -599,6 +600,7 @@ sidebar:
 | [Suspicious IcedID Rundll32 Cmdline](/endpoint/suspicious_icedid_rundll32_cmdline/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP |
 | [Suspicious Image Creation In Appdata Folder](/endpoint/suspicious_image_creation_in_appdata_folder/) | [Screen Capture](/tags/#screen-capture) | TTP |
 | [Suspicious Java Classes]() | None | Anomaly |
+| [Suspicious Kerberos Service Ticket Request](/endpoint/suspicious_kerberos_service_ticket_request/) | [Valid Accounts](/tags/#valid-accounts), [Domain Accounts](/tags/#domain-accounts) | TTP |
 | [Suspicious MSBuild Rename](/endpoint/suspicious_msbuild_rename/) | [Masquerading](/tags/#masquerading), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities), [MSBuild](/tags/#msbuild) | TTP |
 | [Suspicious MSBuild Spawn](/endpoint/suspicious_msbuild_spawn/) | [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [MSBuild](/tags/#msbuild) | TTP |
 | [Suspicious PlistBuddy Usage](/endpoint/suspicious_plistbuddy_usage/) | [Launch Agent](/tags/#launch-agent), [Create or Modify System Process](/tags/#create-or-modify-system-process) | TTP |
@@ -615,6 +617,7 @@ sidebar:
 | [Suspicious SQLite3 LSQuarantine Behavior](/endpoint/suspicious_sqlite3_lsquarantine_behavior/) | [Data Staged](/tags/#data-staged) | TTP |
 | [Suspicious Scheduled Task from Public Directory](/endpoint/suspicious_scheduled_task_from_public_directory/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | Anomaly |
 | [Suspicious SearchProtocolHost no Command Line Arguments](/endpoint/suspicious_searchprotocolhost_no_command_line_arguments/) | [Process Injection](/tags/#process-injection) | TTP |
+| [Suspicious Ticket Granting Ticket Request](/endpoint/suspicious_ticket_granting_ticket_request/) | [Valid Accounts](/tags/#valid-accounts), [Domain Accounts](/tags/#domain-accounts) | Hunting |
 | [Suspicious WAV file in Appdata Folder](/endpoint/suspicious_wav_file_in_appdata_folder/) | [Screen Capture](/tags/#screen-capture) | TTP |
 | [Suspicious microsoft workflow compiler rename](/endpoint/suspicious_microsoft_workflow_compiler_rename/) | [Masquerading](/tags/#masquerading), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities) | Hunting |
 | [Suspicious microsoft workflow compiler usage](/endpoint/suspicious_microsoft_workflow_compiler_usage/) | [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution) | TTP |

docs/_pages/playbooks.md

@@ -11,8 +11,10 @@ sidebar:
 | Name    | Detections | Type        |
 | --------| ---------- | ----------- |
 | [Active Directory Reset password](/playbooks/active_directory_reset_password/)| None | Response |
+| [Block Indicators](/playbooks/block_indicators/)| None | Response |
 | [Crowdstrike Malware Triage](/playbooks/crowdstrike_malware_triage/)| None | Response |
 | [Delete Detected Files](/playbooks/delete_detected_files/)|[Executable File Written in Administrative SMB Share](/endpoint/executable_file_written_in_administrative_smb_share/)| Response |
+| [Email Notification for Malware](/playbooks/email_notification_for_malware/)| None | Response |
 | [Internal Host SSH Investigate](/playbooks/internal_host_ssh_investigate/)| None | Investigation |
 | [Internal Host SSH Log4j Investigate](/playbooks/internal_host_ssh_log4j_investigate/)| None | Investigation |
 | [Internal Host SSH Log4j Response](/playbooks/internal_host_ssh_log4j_response/)| None | Response |
@@ -22,6 +24,7 @@ sidebar:
 | [Log4j Investigate](/playbooks/log4j_investigate/)|[Curl Download and Bash Execution](/endpoint/curl_download_and_bash_execution/)[Wget Download and Bash Execution](/endpoint/wget_download_and_bash_execution/)[Linux Java Spawning Shell](/endpoint/linux_java_spawning_shell/)[Java Class File download by Java User Agent](/endpoint/java_class_file_download_by_java_user_agent/)[Outbound Network Connection from Java Using Default Ports](/endpoint/outbound_network_connection_from_java_using_default_ports/)[Log4Shell JNDI Payload Injection Attempt](/web/log4shell_jndi_payload_injection_attempt/)[Log4Shell JNDI Payload Injection with Outbound Connection](/web/log4shell_jndi_payload_injection_with_outbound_connection/)[Detect Outbound LDAP Traffic](/network/detect_outbound_ldap_traffic/)| Investigate |
 | [Log4j Respond](/playbooks/log4j_respond/)|[Curl Download and Bash Execution](/endpoint/curl_download_and_bash_execution/)[Wget Download and Bash Execution](/endpoint/wget_download_and_bash_execution/)[Linux Java Spawning Shell](/endpoint/linux_java_spawning_shell/)[Java Class File download by Java User Agent](/endpoint/java_class_file_download_by_java_user_agent/)[Outbound Network Connection from Java Using Default Ports](/endpoint/outbound_network_connection_from_java_using_default_ports/)[Log4Shell JNDI Payload Injection Attempt](/web/log4shell_jndi_payload_injection_attempt/)[Log4Shell JNDI Payload Injection with Outbound Connection](/web/log4shell_jndi_payload_injection_with_outbound_connection/)[Detect Outbound LDAP Traffic](/network/detect_outbound_ldap_traffic/)| Response |
 | [Log4j Splunk Investigation](/playbooks/log4j_splunk_investigation/)| None | Investigation |
+| [Malware Hunt and Contain](/playbooks/malware_hunt_and_contain/)| None | Response |
 | [Ransomware Investigate and Contain](/playbooks/ransomware_investigate_and_contain/)|[Conti Common Exec parameter](/endpoint/conti_common_exec_parameter/)| Response |
 | [Risk Notable Block Indicators](/playbooks/risk_notable_block_indicators/)| None | Response |
 | [Risk Notable Enrich](/playbooks/risk_notable_enrich/)| None | Investigation |

docs/_pages/privilege_escalation.md

@@ -3,7 +3,11 @@ title: Privilege Escalation
 layout: tag
 author_profile: false
 taxonomy: Privilege Escalation
-permalink: /detections/privilege_escalation/
+permalink: /stories/privilege_escalation/
 sidebar:
-  nav: "detections"
----
+  nav: "stories"
+---
+
+| Name        | Technique   | Tactic       |
+| ----------- | ----------- |--------------|
+| [sAMAccountName Spoofing and Domain Controller Impersonation](/stories/samaccountname_spoofing_and_domain_controller_impersonation/) | [Valid Accounts](/tags/#valid-accounts), [Domain Accounts](/tags/#domain-accounts) | [Defense Evasion](/tags/#defense-evasion) |

docs/_pages/stories.md

@@ -116,4 +116,5 @@ sidebar:
 | [Windows Persistence Techniques](windows_persistence_techniques) | [Scheduled Task](/tags/#scheduled-task) | [Execution](/tags/#execution) |
 | [Windows Privilege Escalation](windows_privilege_escalation) | [Time Providers](/tags/#time-providers), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | [Persistence](/tags/#persistence) |
 | [Windows Service Abuse](windows_service_abuse) | [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process) | [Persistence](/tags/#persistence) |
-| [XMRig](xmrig) | [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process) | [Persistence](/tags/#persistence) |
+| [XMRig](xmrig) | [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process) | [Persistence](/tags/#persistence) |
+| [sAMAccountName Spoofing and Domain Controller Impersonation](samaccountname_spoofing_and_domain_controller_impersonation) | [Valid Accounts](/tags/#valid-accounts), [Domain Accounts](/tags/#domain-accounts) | [Defense Evasion](/tags/#defense-evasion) |

docs/_playbooks/block_indicators.md

@@ -0,0 +1,46 @@
+---
+title: "Block Indicators"
+last_modified_at: 2021-01-21
+toc: true
+toc_label: ""
+tags:
+  - Response
+  - Splunk SOAR
+  - Palo Alto Networks Firewall
+  - CarbonBlack Response
+  - OpenDNS Umbrella
+---
+
+[Try in Splunk SOAR](https://www.splunk.com/en_us/software/splunk-security-orchestration-and-automation.html){: .btn .btn--success}
+
+#### Description
+
+This playbook retrieves IP addresses, domains, and file hashes, blocks them on various services, and adds them to specific blocklists as custom lists.
+
+- **Type**: Response
+- **Product**: Splunk SOAR
+- **Apps**: [Palo Alto Networks Firewall](https://splunkbase.splunk.com/apps/#/search/Palo Alto Networks Firewall/product/soar), [CarbonBlack Response](https://splunkbase.splunk.com/apps/#/search/CarbonBlack Response/product/soar), [OpenDNS Umbrella](https://splunkbase.splunk.com/apps/#/search/OpenDNS Umbrella/product/soar)
+- **Last Updated**: 2021-01-21
+- **Author**: Philip Royer, Splunk
+- **ID**: fc0edc76-ff2b-48b0-5f6f-63da6783fd63
+
+#### Associated Detections
+
+
+#### How To Implement
+This playbook uses the following custom lists:  ip_address_blocklist, domain_blocklist, filehash_blocklist. This playbook provides an easy, automated, and straightforward solution to maintaining up-to-date IP address, file, and domain blocklists. The playbook looks for any of the required CEF fields within the container. The CEF value is then cross-referenced with their respective Custom Lists. IP addresses are blocked on a Firewall, while domains are blocked using a blocklist service.  The blocking of these two will prevent access to the IOCs.  Finally, file hashes are blocked using an endpoint protection service, which will prevent the process from running on affected endpoints within a network. After the IOCs are blocked using various apps, they are added to their respective custom lists as to maintain a running blocklist record.
+
+#### Playbooks
+![](https://raw.githubusercontent.com/splunk/security_content/develop/playbooks/block_indicators.png)
+
+#### Required field
+* destinationDnsDomain
+* destinationAddress
+* fileHash
+
+
+#### Reference
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/playbooks/block_indicators.yml) \| *version*: **1**

docs/_playbooks/delete_detected_files.md

@@ -719,6 +719,9 @@ This playbook acts upon events where a file has been determined to be malicious
 
 
 
+
+
+
 
 
 

docs/_playbooks/email_notification_for_malware.md

@@ -0,0 +1,46 @@
+---
+title: "Email Notification for Malware"
+last_modified_at: 2021-01-19
+toc: true
+toc_label: ""
+tags:
+  - Response
+  - Splunk SOAR
+  - VirusTotal
+  - WildFire
+  - CarbonBlack Response
+  - SMTP
+---
+
+[Try in Splunk SOAR](https://www.splunk.com/en_us/software/splunk-security-orchestration-and-automation.html){: .btn .btn--success}
+
+#### Description
+
+This playbook tries to determine if a file is malware and whether or not the file is present on any managed machines. VirusTotal "file reputation" and PAN WildFire "detonate file" are used to determine if a file is malware, and CarbonBlack Response "hunt file" is used to search managed machines for the file. The results of these investigations are summarized in an email to the incident response team.
+
+- **Type**: Response
+- **Product**: Splunk SOAR
+- **Apps**: [VirusTotal](https://splunkbase.splunk.com/apps/#/search/VirusTotal/product/soar), [WildFire](https://splunkbase.splunk.com/apps/#/search/WildFire/product/soar), [CarbonBlack Response](https://splunkbase.splunk.com/apps/#/search/CarbonBlack Response/product/soar), [SMTP](https://splunkbase.splunk.com/apps/#/search/SMTP/product/soar)
+- **Last Updated**: 2021-01-19
+- **Author**: Philip Royer, Splunk
+- **ID**: fb3edc76-ff2b-48b0-5f6f-63da6483fd63
+
+#### Associated Detections
+
+
+#### How To Implement
+Be sure to update asset naming to reflect the asset names configured in your environment.
+
+#### Playbooks
+![](https://raw.githubusercontent.com/splunk/security_content/develop/playbooks/email_notification_for_malware.png)
+
+#### Required field
+* fileHash
+* vaultId
+
+
+#### Reference
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/playbooks/email_notification_for_malware.yml) \| *version*: **1**

docs/_playbooks/log4j_investigate.md

@@ -1369,6 +1369,12 @@ Published in response to CVE-2021-44228, this playbook and its sub-playbooks can
 
 
 
+
+
+
+
+
+
 
 
 
@@ -3162,6 +3168,12 @@ Published in response to CVE-2021-44228, this playbook and its sub-playbooks can
 
 
 
+
+
+
+
+
+
 
 
 
@@ -3952,6 +3964,9 @@ Published in response to CVE-2021-44228, this playbook and its sub-playbooks can
 
 
 
+
+
+
 
 
 
@@ -4574,6 +4589,9 @@ Published in response to CVE-2021-44228, this playbook and its sub-playbooks can
 
 
 
+
+
+
 
 
 
@@ -5273,6 +5291,9 @@ Published in response to CVE-2021-44228, this playbook and its sub-playbooks can
 
 
 
+
+
+
 
 
 
@@ -5753,6 +5774,9 @@ Published in response to CVE-2021-44228, this playbook and its sub-playbooks can
 
 
 
+
+
+
 
 
 
@@ -6301,6 +6325,9 @@ Published in response to CVE-2021-44228, this playbook and its sub-playbooks can
 
 
 
+
+
+
 
 
 

docs/_playbooks/log4j_respond.md

@@ -1369,6 +1369,12 @@ Published in response to CVE-2021-44228, this playbook is meant to be launched a
 
 
 
+
+
+
+
+
+
 
 
 
@@ -3162,6 +3168,12 @@ Published in response to CVE-2021-44228, this playbook is meant to be launched a
 
 
 
+
+
+
+
+
+
 
 
 
@@ -3952,6 +3964,9 @@ Published in response to CVE-2021-44228, this playbook is meant to be launched a
 
 
 
+
+
+
 
 
 
@@ -4574,6 +4589,9 @@ Published in response to CVE-2021-44228, this playbook is meant to be launched a
 
 
 
+
+
+
 
 
 
@@ -5273,6 +5291,9 @@ Published in response to CVE-2021-44228, this playbook is meant to be launched a
 
 
 
+
+
+
 
 
 
@@ -5753,6 +5774,9 @@ Published in response to CVE-2021-44228, this playbook is meant to be launched a
 
 
 
+
+
+
 
 
 
@@ -6301,6 +6325,9 @@ Published in response to CVE-2021-44228, this playbook is meant to be launched a
 
 
 
+
+
+
 
 
 

docs/_playbooks/malware_hunt_and_contain.md

@@ -0,0 +1,45 @@
+---
+title: "Malware Hunt and Contain"
+last_modified_at: 2021-01-21
+toc: true
+toc_label: ""
+tags:
+  - Response
+  - Splunk SOAR
+  - LDAP
+  - ServiceNow
+  - CarbonBlack Response
+  - VirusTotal
+---
+
+[Try in Splunk SOAR](https://www.splunk.com/en_us/software/splunk-security-orchestration-and-automation.html){: .btn .btn--success}
+
+#### Description
+
+This playbook investigates and remediates malware infections on the endpoint.
+
+- **Type**: Response
+- **Product**: Splunk SOAR
+- **Apps**: [LDAP](https://splunkbase.splunk.com/apps/#/search/LDAP/product/soar), [ServiceNow](https://splunkbase.splunk.com/apps/#/search/ServiceNow/product/soar), [CarbonBlack Response](https://splunkbase.splunk.com/apps/#/search/CarbonBlack Response/product/soar), [VirusTotal](https://splunkbase.splunk.com/apps/#/search/VirusTotal/product/soar)
+- **Last Updated**: 2021-01-21
+- **Author**: Philip Royer, Splunk
+- **ID**: fb3edc76-ff2b-43c0-5f6f-63da4483fd63
+
+#### Associated Detections
+
+
+#### How To Implement
+Be sure to update asset naming to reflect the asset names configured in your environment.
+
+#### Playbooks
+![](https://raw.githubusercontent.com/splunk/security_content/develop/playbooks/malware_hunt_and_contain.png)
+
+#### Required field
+* fileHash
+
+
+#### Reference
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/playbooks/malware_hunt_and_contain.yml) \| *version*: **1**

docs/_playbooks/ransomware_investigate_and_contain.md

@@ -723,6 +723,9 @@ This playbook investigates and contains ransomware detected on endpoints.
 
 
 
+
+
+
 
 
 

docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md

@@ -14,7 +14,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2017-09-13-detect_unauthorized_assets_by_mac_address.md

@@ -14,7 +14,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md

@@ -14,7 +14,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md

@@ -14,7 +14,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2017-09-20-large_volume_of_dns_any_queries.md

@@ -18,7 +18,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md

@@ -16,7 +16,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md

@@ -14,7 +14,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md

@@ -14,7 +14,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2017-10-13-unusually_long_content-type_length.md

@@ -13,7 +13,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md

@@ -14,7 +14,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2018-05-07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md

@@ -13,7 +13,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md

@@ -16,7 +16,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md

@@ -15,7 +15,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2018-10-23-wmi_permanent_event_subscription.md

@@ -15,7 +15,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2018-10-23-wmi_temporary_event_subscription.md

@@ -15,7 +15,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2018-11-27-detect_spike_in_s3_bucket_deletion.md

@@ -15,7 +15,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2018-12-06-suspicious_java_classes.md

@@ -13,7 +13,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2019-01-25-processes_tapping_keyboard_events.md

@@ -13,7 +13,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md

@@ -16,7 +16,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md

@@ -13,7 +13,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md

@@ -18,7 +18,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2020-02-07-macos_-_re-opened_applications.md

@@ -14,7 +14,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md

@@ -15,7 +15,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md

@@ -17,7 +17,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2020-03-16-detect_rare_executables.md

@@ -14,7 +14,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2020-03-16-spike_in_file_writes.md

@@ -13,7 +13,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md

@@ -15,7 +15,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md

@@ -15,7 +15,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md

@@ -16,7 +16,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2020-06-23-kubernetes_aws_detect_suspicious_kubectl_calls.md

@@ -13,7 +13,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2020-07-07-remote_desktop_network_traffic.md

@@ -18,7 +18,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2020-07-17-gcp_kubernetes_cluster_pod_scan_detection.md

@@ -15,7 +15,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2020-07-21-detect_outbound_smb_traffic.md

@@ -18,7 +18,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md

@@ -17,7 +17,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md

@@ -17,7 +17,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md

@@ -18,7 +18,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2020-07-21-email_servers_sending_high_volume_traffic_to_hosts.md

@@ -18,7 +18,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2020-07-21-excessive_dns_failures.md

@@ -18,7 +18,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2020-07-21-first_time_seen_running_windows_service.md

@@ -17,7 +17,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2020-07-21-hosts_receiving_high_volume_of_network_traffic_from_email_server.md

@@ -18,7 +18,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md

@@ -23,7 +23,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2020-07-21-okta_account_lockout_events.md

@@ -23,7 +23,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2020-07-21-okta_failed_sso_attempts.md

@@ -23,7 +23,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md

@@ -23,7 +23,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md

@@ -16,7 +16,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2020-07-21-protocol_or_port_mismatch.md

@@ -18,7 +18,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2020-07-21-remote_desktop_network_bruteforce.md

@@ -18,7 +18,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md

@@ -18,7 +18,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2020-07-21-sql_injection_with_long_urls.md

@@ -16,7 +16,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2020-07-22-smb_traffic_spike.md

@@ -18,7 +18,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2020-07-22-smb_traffic_spike_-_mltk.md

@@ -18,7 +18,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md

@@ -18,7 +18,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2020-07-22-tor_traffic.md

@@ -18,7 +18,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2020-07-27-aws_detect_attach_to_role_policy.md

@@ -18,7 +18,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2020-07-27-aws_detect_permanent_key_creation.md

@@ -18,7 +18,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2020-07-27-aws_detect_role_creation.md

@@ -18,7 +18,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2020-07-27-aws_detect_sts_assume_role_abuse.md

@@ -18,7 +18,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2020-07-27-aws_detect_sts_get_session_token_abuse.md

@@ -16,7 +16,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md

@@ -16,7 +16,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2020-07-28-detect_windows_dns_sigred_via_zeek.md

@@ -17,7 +17,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md

@@ -16,7 +16,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2020-08-05-detect_new_open_gcp_storage_buckets.md

@@ -15,7 +15,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2020-08-10-detect_gcp_storage_access_from_a_new_ip.md

@@ -15,7 +15,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2020-08-11-detect_arp_poisoning.md

@@ -23,7 +23,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2020-08-11-detect_rogue_dhcp_server.md

@@ -20,7 +20,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_destroyed.md

@@ -25,7 +25,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_launched.md

@@ -25,7 +25,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2020-08-25-phishing_email_detection_by_machine_learning_method_-_ssa.md

@@ -13,7 +13,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2020-09-15-detect_zerologon_via_zeek.md

@@ -16,7 +16,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2020-09-18-detect_computer_changed_with_anonymous_account.md

@@ -16,7 +16,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2020-10-08-gcp_detect_gcploit_framework.md

@@ -18,7 +18,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2020-10-21-detect_snicat_sni_exfiltration.md

@@ -15,7 +15,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md

@@ -23,7 +23,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2020-10-28-detect_port_security_violation.md

@@ -23,7 +23,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2020-10-28-detect_software_download_to_network_device.md

@@ -20,7 +20,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2020-10-28-detect_traffic_mirroring.md

@@ -21,7 +21,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}

docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md

@@ -15,7 +15,7 @@ tags:
 ---
 
 ### ⚠️ WARNING THIS IS A EXPERIMENTAL DETECTION
-We have not been able to test, simulate or build datasets for it, use at your own risk!
+We have not been able to test, simulate, or build datasets for this detection. Use at your own risk. This analytic is **NOT** supported.
 
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}