From 5ad56eb8381fcea9742d718c3b5c647d5d265392 Mon Sep 17 00:00:00 2001
From: research bot <research@splunk.com>
Date: Tue, 27 Sep 2022 13:35:18 +0000
Subject: [PATCH 01/10] updating docs and package bits [ci skip]

---
 dist/escu/app.manifest                        |  2 +-
 dist/escu/default/analyticstories.conf        | 22 ++---
 dist/escu/default/app.conf                    |  4 +-
 dist/escu/default/collections.conf            |  2 +-
 dist/escu/default/content-version.conf        |  2 +-
 dist/escu/default/es_investigations.conf      |  2 +-
 dist/escu/default/macros.conf                 |  2 +-
 dist/escu/default/savedsearches.conf          | 94 +++++++++----------
 dist/escu/default/transforms.conf             |  2 +-
 dist/escu/default/workflow_actions.conf       |  2 +-
 ...execution_compiled_html_file_decompile.yml |  2 +-
 11 files changed, 68 insertions(+), 68 deletions(-)

diff --git a/dist/escu/app.manifest b/dist/escu/app.manifest
index f1cfd7c3bb..55abc3f4fb 100644
--- a/dist/escu/app.manifest
+++ b/dist/escu/app.manifest
@@ -5,7 +5,7 @@
     "id": {
       "group": null, 
       "name": "DA-ESS-ContentUpdate", 
-      "version": "3.49.0"
+      "version": "3.49.1"
     }, 
     "author": [
       {
diff --git a/dist/escu/default/analyticstories.conf b/dist/escu/default/analyticstories.conf
index 4135bd7b74..32671a12bc 100644
--- a/dist/escu/default/analyticstories.conf
+++ b/dist/escu/default/analyticstories.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-09-20T15:09:11 UTC
+# On Date: 2022-09-27T00:24:02 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -3115,7 +3115,7 @@ providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response"
 type = detection
 asset_type = Endpoint
 confidence = medium
-explanation = This particular behavior is typically executed when an adversaries or malware gains access to an endpoint and beings to perform execution and to evade detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated.
+explanation = This particular behavior is typically executed when an adversary or malware gains access to an endpoint and begins to perform execution and to evade detections. Usually, a batch (.bat) file will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated.
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
 known_false_positives = admin or user may choose to disable windows defender product
@@ -3125,7 +3125,7 @@ providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response"
 type = detection
 asset_type = Endpoint
 confidence = medium
-explanation = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the BlockAtFirstSeen feature where it block suspicious file first seen in the host.
+explanation = This analytic is intended to detect a suspicious modification of the Windows registry to disable a Windows Defender feature. This technique is intended to bypass or evade detection from Windows Defender AV, specifically the BlockAtFirstSeen feature where it blocks suspicious files the first time seen on the host.
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
 known_false_positives = admin or user may choose to disable windows defender product
@@ -3135,7 +3135,7 @@ providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response"
 type = detection
 asset_type = Endpoint
 confidence = medium
-explanation = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the Enhanced Notification feature wher user or admin set to show or display alerts.
+explanation = This analytic is intended to detect a suspicious modification of registry to disable windows defender features. This technique attempts to bypass or evade detection from Windows Defender AV, specifically the Enhanced Notification feature where a user or admin would receive alerts.
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
 known_false_positives = user may choose to disable windows defender AV
@@ -3145,7 +3145,7 @@ providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response"
 type = detection
 asset_type = Endpoint
 confidence = medium
-explanation = This particular behavior is typically executed when an adversaries or malware gains access to an endpoint and beings to perform execution and to evade detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated.
+explanation = This particular behavior is typically executed when an adversary or malware gains access to an endpoint and begins to perform execution and to evade detections. Usually, a batch (.bat) file will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated.
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
 known_false_positives = admin or user may choose to disable windows defender product
@@ -3155,7 +3155,7 @@ providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response"
 type = detection
 asset_type = Endpoint
 confidence = medium
-explanation = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the spynet reporting for its telemetry.
+explanation = This analytic is intended to detect a suspicious modification of registry to disable Windows Defender feature. This technique is intended to bypass or evade detection from Windows Defender AV product, specifically the spynet reporting for Defender telemetry.
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
 known_false_positives = admin or user may choose to disable windows defender product
@@ -3165,7 +3165,7 @@ providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response"
 type = detection
 asset_type = Endpoint
 confidence = medium
-explanation = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the submit samples feature for further analysis..
+explanation = This analytic is intended to detect a suspicious modification of the Windows registry to disable a Windows Defender feature. This technique is intended to bypass or evade detection from Windows Defender AV, specifically the feature that submits samples for further analysis.
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
 known_false_positives = admin or user may choose to disable windows defender product
@@ -3205,7 +3205,7 @@ providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response"
 type = detection
 asset_type = Endpoint
 confidence = medium
-explanation = This analytic is to detect a suspicious commandline to disable existing schedule task. This technique is used by adversaries or commodity malware like IceID to disable security application (AV products) in the targetted host to evade detections. This TTP is a good pivot to check further why and what other process run before and after this detection. check which process execute the commandline and what task is disabled. parent child process is quite valuable in this scenario too.
+explanation = This analytic is to detect a suspicious commandline to disable existing schedule task. This technique is used by adversaries or commodity malware like IcedID to disable security application (AV products) in the targetted host to evade detections. This TTP is a good pivot to check further why and what other process run before and after this detection. check which process execute the commandline and what task is disabled. parent child process is quite valuable in this scenario too.
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
 known_false_positives = admin may disable problematic schedule task
@@ -7388,7 +7388,7 @@ providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response"
 type = detection
 asset_type = Endpoint
 confidence = medium
-explanation = This search is to detect a suspicious rundll32.exe process with plugininit parameter. This technique is commonly seen in IceID malware to execute its initial dll stager to download another payload to the compromised machine.
+explanation = This search is to detect a suspicious rundll32.exe process with plugininit parameter. This technique is commonly seen in IcedID malware to execute its initial dll stager to download another payload to the compromised machine.
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.011"]}
 known_false_positives = third party application may used this dll export name to execute function.
@@ -9314,7 +9314,7 @@ providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response"
 type = detection
 asset_type = Endpoint
 confidence = medium
-explanation = This analytic indentifies WMIC command-line attempting to uninstall application non-interactively. This technique was seen in IceID to uninstall AV products on the compromised host to evade detection. This Hunting query maybe a good indicator that some process tries to uninstall application using wmic which is not a common behavior. This approach may seen in some script or third part appication to uninstall their application but it is a good thing to check what it uninstall and why.
+explanation = This analytic indentifies WMIC command-line attempting to uninstall application non-interactively. This technique was seen in IcedID to uninstall AV products on the compromised host to evade detection. This Hunting query maybe a good indicator that some process tries to uninstall application using wmic which is not a common behavior. This approach may seen in some script or third part appication to uninstall their application but it is a good thing to check what it uninstall and why.
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
 known_false_positives = Third party application may use this approach to uninstall applications.
@@ -10613,7 +10613,7 @@ version = 1
 references = ["https://threatpost.com/icedid-banking-trojan-surges-emotet/165314/", "https://app.any.run/tasks/48414a33-3d66-4a46-afe5-c2003bb55ccf/"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Teoderick Contreras"}]
 spec_version = 3
-searches = ["ESCU - Account Discovery With Net App - Rule", "ESCU - CHCP Command Execution - Rule", "ESCU - CMD Carry Out String Command Parameter - Rule", "ESCU - Create Remote Thread In Shell Application - Rule", "ESCU - Disable Schedule Task - Rule", "ESCU - Drop IcedID License dat - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - IcedID Exfiltrated Archived File Creation - Rule", "ESCU - Mshta spawning Rundll32 OR Regsvr32 Process - Rule", "ESCU - NLTest Domain Trust Discovery - Rule", "ESCU - Office Application Spawn Regsvr32 process - Rule", "ESCU - Office Application Spawn rundll32 process - Rule", "ESCU - Office Document Executing Macro Code - Rule", "ESCU - Office Product Spawning MSHTA - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Regsvr32 with Known Silent Switch Cmdline - Rule", "ESCU - Rundll32 Create Remote Thread To A Process - Rule", "ESCU - Rundll32 CreateRemoteThread In Browser - Rule", "ESCU - Rundll32 DNSQuery - Rule", "ESCU - Rundll32 Process Creating Exe Dll Files - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Sqlite Module In Temp Folder - Rule", "ESCU - Suspicious IcedID Rundll32 Cmdline - Rule", "ESCU - Suspicious Rundll32 PluginInit - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Windows Task Scheduler Event Action Started - Rule"]
+searches = ["ESCU - Account Discovery With Net App - Rule", "ESCU - CHCP Command Execution - Rule", "ESCU - CMD Carry Out String Command Parameter - Rule", "ESCU - Create Remote Thread In Shell Application - Rule", "ESCU - Disable Defender AntiVirus Registry - Rule", "ESCU - Disable Defender BlockAtFirstSeen Feature - Rule", "ESCU - Disable Defender Enhanced Notification - Rule", "ESCU - Disable Defender MpEngine Registry - Rule", "ESCU - Disable Defender Spynet Reporting - Rule", "ESCU - Disable Defender Submit Samples Consent Feature - Rule", "ESCU - Disable Schedule Task - Rule", "ESCU - Disabling Defender Services - Rule", "ESCU - Drop IcedID License dat - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - IcedID Exfiltrated Archived File Creation - Rule", "ESCU - Mshta spawning Rundll32 OR Regsvr32 Process - Rule", "ESCU - NLTest Domain Trust Discovery - Rule", "ESCU - Office Application Spawn Regsvr32 process - Rule", "ESCU - Office Application Spawn rundll32 process - Rule", "ESCU - Office Document Executing Macro Code - Rule", "ESCU - Office Product Spawning MSHTA - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Regsvr32 with Known Silent Switch Cmdline - Rule", "ESCU - Rundll32 Create Remote Thread To A Process - Rule", "ESCU - Rundll32 CreateRemoteThread In Browser - Rule", "ESCU - Rundll32 DNSQuery - Rule", "ESCU - Rundll32 Process Creating Exe Dll Files - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Sqlite Module In Temp Folder - Rule", "ESCU - Suspicious IcedID Rundll32 Cmdline - Rule", "ESCU - Suspicious Rundll32 PluginInit - Rule", "ESCU - Windows Curl Download to Suspicious Path - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Windows Task Scheduler Event Action Started - Rule", "ESCU - Wmic NonInteractive App Uninstallation - Rule"]
 description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the IcedID banking trojan, including looking for file writes associated with its payload, process injection, shellcode execution and data collection.
 narrative = IcedId banking trojan campaigns targeting banks and other vertical sectors.This malware is known in Microsoft Windows OS targetting browser such as firefox and chrom to steal banking information. It is also known to its unique payload downloaded in C2 where it can be a .png file that hides the core shellcode bot using steganography technique or gzip dat file that contains "license.dat" which is the actual core icedid bot.
 
diff --git a/dist/escu/default/app.conf b/dist/escu/default/app.conf
index 45b84bfb54..561a2c458c 100644
--- a/dist/escu/default/app.conf
+++ b/dist/escu/default/app.conf
@@ -4,7 +4,7 @@
 is_configured = false
 state = enabled
 state_change_requires_restart = false
-build = 10018
+build = 10110
 
 [triggers]
 reload.analytic_stories = simple
@@ -20,7 +20,7 @@ reload.es_investigations = simple
 
 [launcher]
 author = Splunk
-version = 3.49.0
+version = 3.49.1
 description = Explore the Analytic Stories included with ES Content Updates.
 
 [ui]
diff --git a/dist/escu/default/collections.conf b/dist/escu/default/collections.conf
index 09ea68cf6f..d879e9f567 100644
--- a/dist/escu/default/collections.conf
+++ b/dist/escu/default/collections.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-09-20T15:09:11 UTC
+# On Date: 2022-09-27T00:24:02 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
diff --git a/dist/escu/default/content-version.conf b/dist/escu/default/content-version.conf
index e17e082e60..fd1c542b7a 100644
--- a/dist/escu/default/content-version.conf
+++ b/dist/escu/default/content-version.conf
@@ -1,2 +1,2 @@
 [content-version]
-version = 3.49.0
+version = 3.49.1
diff --git a/dist/escu/default/es_investigations.conf b/dist/escu/default/es_investigations.conf
index 3f4e51bfd1..c766e23275 100644
--- a/dist/escu/default/es_investigations.conf
+++ b/dist/escu/default/es_investigations.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-09-20T15:09:11 UTC
+# On Date: 2022-09-27T00:24:02 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
diff --git a/dist/escu/default/macros.conf b/dist/escu/default/macros.conf
index 7c7ac28d1f..acc3de0097 100644
--- a/dist/escu/default/macros.conf
+++ b/dist/escu/default/macros.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-09-20T15:09:11 UTC
+# On Date: 2022-09-27T00:24:02 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
diff --git a/dist/escu/default/savedsearches.conf b/dist/escu/default/savedsearches.conf
index 8e560e9b73..f2988eb6eb 100644
--- a/dist/escu/default/savedsearches.conf
+++ b/dist/escu/default/savedsearches.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-09-20T15:09:11 UTC
+# On Date: 2022-09-27T00:24:02 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -13263,10 +13263,10 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime
 [ESCU - Disable Defender AntiVirus Registry - Rule]
 action.escu = 0
 action.escu.enabled = 1
-description = This particular behavior is typically executed when an adversaries or malware gains access to an endpoint and beings to perform execution and to evade detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated.
+description = This particular behavior is typically executed when an adversary or malware gains access to an endpoint and begins to perform execution and to evade detections. Usually, a batch (.bat) file will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated.
 action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
 action.escu.data_models = ["Endpoint"]
-action.escu.eli5 = This particular behavior is typically executed when an adversaries or malware gains access to an endpoint and beings to perform execution and to evade detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated.
+action.escu.eli5 = This particular behavior is typically executed when an adversary or malware gains access to an endpoint and begins to perform execution and to evade detections. Usually, a batch (.bat) file will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated.
 action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 action.escu.known_false_positives = admin or user may choose to disable windows defender product
 action.escu.creation_date = 2022-01-26
@@ -13276,7 +13276,7 @@ action.escu.full_search_name = ESCU - Disable Defender AntiVirus Registry - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
-action.escu.analytic_story = ["IceID", "Windows Registry Abuse"]
+action.escu.analytic_story = ["IcedID", "Windows Registry Abuse"]
 action.risk = 1
 action.risk.param._risk_message = modified/added/deleted registry entry $registry_path$ in $dest$
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}]
@@ -13287,11 +13287,11 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Disable Defender AntiVirus Registry - Rule
-action.correlationsearch.annotations = {"analytic_story": ["IceID", "Windows Registry Abuse"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
+action.correlationsearch.annotations = {"analytic_story": ["IcedID", "Windows Registry Abuse"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
-action.notable.param.rule_description = This particular behavior is typically executed when an adversaries or malware gains access to an endpoint and beings to perform execution and to evade detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated.
+action.notable.param.rule_description = This particular behavior is typically executed when an adversary or malware gains access to an endpoint and begins to perform execution and to evade detections. Usually, a batch (.bat) file will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated.
 action.notable.param.rule_title = Disable Defender AntiVirus Registry
 action.notable.param.security_domain = endpoint
 action.notable.param.severity = high
@@ -13309,10 +13309,10 @@ search = | tstats `security_content_summariesonly` count from datamodel=Endpoint
 [ESCU - Disable Defender BlockAtFirstSeen Feature - Rule]
 action.escu = 0
 action.escu.enabled = 1
-description = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the BlockAtFirstSeen feature where it block suspicious file first seen in the host.
+description = This analytic is intended to detect a suspicious modification of the Windows registry to disable a Windows Defender feature. This technique is intended to bypass or evade detection from Windows Defender AV, specifically the BlockAtFirstSeen feature where it blocks suspicious files the first time seen on the host.
 action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
 action.escu.data_models = ["Endpoint"]
-action.escu.eli5 = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the BlockAtFirstSeen feature where it block suspicious file first seen in the host.
+action.escu.eli5 = This analytic is intended to detect a suspicious modification of the Windows registry to disable a Windows Defender feature. This technique is intended to bypass or evade detection from Windows Defender AV, specifically the BlockAtFirstSeen feature where it blocks suspicious files the first time seen on the host.
 action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 action.escu.known_false_positives = admin or user may choose to disable windows defender product
 action.escu.creation_date = 2022-01-26
@@ -13322,7 +13322,7 @@ action.escu.full_search_name = ESCU - Disable Defender BlockAtFirstSeen Feature
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
-action.escu.analytic_story = ["IceID", "Windows Registry Abuse", "Azorult"]
+action.escu.analytic_story = ["IcedID", "Windows Registry Abuse", "Azorult"]
 action.risk = 1
 action.risk.param._risk_message = modified/added/deleted registry entry $registry_path$ in $dest$
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}]
@@ -13333,11 +13333,11 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Disable Defender BlockAtFirstSeen Feature - Rule
-action.correlationsearch.annotations = {"analytic_story": ["IceID", "Windows Registry Abuse", "Azorult"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
+action.correlationsearch.annotations = {"analytic_story": ["IcedID", "Windows Registry Abuse", "Azorult"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
-action.notable.param.rule_description = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the BlockAtFirstSeen feature where it block suspicious file first seen in the host.
+action.notable.param.rule_description = This analytic is intended to detect a suspicious modification of the Windows registry to disable a Windows Defender feature. This technique is intended to bypass or evade detection from Windows Defender AV, specifically the BlockAtFirstSeen feature where it blocks suspicious files the first time seen on the host.
 action.notable.param.rule_title = Disable Defender BlockAtFirstSeen Feature
 action.notable.param.security_domain = endpoint
 action.notable.param.severity = high
@@ -13355,10 +13355,10 @@ search = | tstats `security_content_summariesonly` count from datamodel=Endpoint
 [ESCU - Disable Defender Enhanced Notification - Rule]
 action.escu = 0
 action.escu.enabled = 1
-description = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the Enhanced Notification feature wher user or admin set to show or display alerts.
+description = This analytic is intended to detect a suspicious modification of registry to disable windows defender features. This technique attempts to bypass or evade detection from Windows Defender AV, specifically the Enhanced Notification feature where a user or admin would receive alerts.
 action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
 action.escu.data_models = ["Endpoint"]
-action.escu.eli5 = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the Enhanced Notification feature wher user or admin set to show or display alerts.
+action.escu.eli5 = This analytic is intended to detect a suspicious modification of registry to disable windows defender features. This technique attempts to bypass or evade detection from Windows Defender AV, specifically the Enhanced Notification feature where a user or admin would receive alerts.
 action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 action.escu.known_false_positives = user may choose to disable windows defender AV
 action.escu.creation_date = 2022-01-26
@@ -13368,7 +13368,7 @@ action.escu.full_search_name = ESCU - Disable Defender Enhanced Notification - R
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
-action.escu.analytic_story = ["IceID", "Windows Registry Abuse", "Azorult"]
+action.escu.analytic_story = ["IcedID", "Windows Registry Abuse", "Azorult"]
 action.risk = 1
 action.risk.param._risk_message = modified/added/deleted registry entry $registry_path$ in $dest$
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}]
@@ -13379,11 +13379,11 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Disable Defender Enhanced Notification - Rule
-action.correlationsearch.annotations = {"analytic_story": ["IceID", "Windows Registry Abuse", "Azorult"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
+action.correlationsearch.annotations = {"analytic_story": ["IcedID", "Windows Registry Abuse", "Azorult"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
-action.notable.param.rule_description = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the Enhanced Notification feature wher user or admin set to show or display alerts.
+action.notable.param.rule_description = This analytic is intended to detect a suspicious modification of registry to disable windows defender features. This technique attempts to bypass or evade detection from Windows Defender AV, specifically the Enhanced Notification feature where a user or admin would receive alerts.
 action.notable.param.rule_title = Disable Defender Enhanced Notification
 action.notable.param.security_domain = endpoint
 action.notable.param.severity = high
@@ -13401,10 +13401,10 @@ search = | tstats `security_content_summariesonly` count from datamodel=Endpoint
 [ESCU - Disable Defender MpEngine Registry - Rule]
 action.escu = 0
 action.escu.enabled = 1
-description = This particular behavior is typically executed when an adversaries or malware gains access to an endpoint and beings to perform execution and to evade detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated.
+description = This particular behavior is typically executed when an adversary or malware gains access to an endpoint and begins to perform execution and to evade detections. Usually, a batch (.bat) file will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated.
 action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
 action.escu.data_models = ["Endpoint"]
-action.escu.eli5 = This particular behavior is typically executed when an adversaries or malware gains access to an endpoint and beings to perform execution and to evade detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated.
+action.escu.eli5 = This particular behavior is typically executed when an adversary or malware gains access to an endpoint and begins to perform execution and to evade detections. Usually, a batch (.bat) file will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated.
 action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 action.escu.known_false_positives = admin or user may choose to disable windows defender product
 action.escu.creation_date = 2022-01-26
@@ -13414,7 +13414,7 @@ action.escu.full_search_name = ESCU - Disable Defender MpEngine Registry - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
-action.escu.analytic_story = ["IceID", "Windows Registry Abuse"]
+action.escu.analytic_story = ["IcedID", "Windows Registry Abuse"]
 action.risk = 1
 action.risk.param._risk_message = modified/added/deleted registry entry $registry_path$ in $dest$
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}]
@@ -13425,11 +13425,11 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Disable Defender MpEngine Registry - Rule
-action.correlationsearch.annotations = {"analytic_story": ["IceID", "Windows Registry Abuse"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
+action.correlationsearch.annotations = {"analytic_story": ["IcedID", "Windows Registry Abuse"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
-action.notable.param.rule_description = This particular behavior is typically executed when an adversaries or malware gains access to an endpoint and beings to perform execution and to evade detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated.
+action.notable.param.rule_description = This particular behavior is typically executed when an adversary or malware gains access to an endpoint and begins to perform execution and to evade detections. Usually, a batch (.bat) file will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated.
 action.notable.param.rule_title = Disable Defender MpEngine Registry
 action.notable.param.security_domain = endpoint
 action.notable.param.severity = high
@@ -13447,10 +13447,10 @@ search = | tstats `security_content_summariesonly` count from datamodel=Endpoint
 [ESCU - Disable Defender Spynet Reporting - Rule]
 action.escu = 0
 action.escu.enabled = 1
-description = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the spynet reporting for its telemetry.
+description = This analytic is intended to detect a suspicious modification of registry to disable Windows Defender feature. This technique is intended to bypass or evade detection from Windows Defender AV product, specifically the spynet reporting for Defender telemetry.
 action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
 action.escu.data_models = ["Endpoint"]
-action.escu.eli5 = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the spynet reporting for its telemetry.
+action.escu.eli5 = This analytic is intended to detect a suspicious modification of registry to disable Windows Defender feature. This technique is intended to bypass or evade detection from Windows Defender AV product, specifically the spynet reporting for Defender telemetry.
 action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 action.escu.known_false_positives = admin or user may choose to disable windows defender product
 action.escu.creation_date = 2022-01-26
@@ -13460,7 +13460,7 @@ action.escu.full_search_name = ESCU - Disable Defender Spynet Reporting - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
-action.escu.analytic_story = ["IceID", "Windows Registry Abuse", "Azorult"]
+action.escu.analytic_story = ["IcedID", "Windows Registry Abuse", "Azorult"]
 action.risk = 1
 action.risk.param._risk_message = modified/added/deleted registry entry $registry_path$ in $dest$
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}]
@@ -13471,11 +13471,11 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Disable Defender Spynet Reporting - Rule
-action.correlationsearch.annotations = {"analytic_story": ["IceID", "Windows Registry Abuse", "Azorult"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
+action.correlationsearch.annotations = {"analytic_story": ["IcedID", "Windows Registry Abuse", "Azorult"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
-action.notable.param.rule_description = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the spynet reporting for its telemetry.
+action.notable.param.rule_description = This analytic is intended to detect a suspicious modification of registry to disable Windows Defender feature. This technique is intended to bypass or evade detection from Windows Defender AV product, specifically the spynet reporting for Defender telemetry.
 action.notable.param.rule_title = Disable Defender Spynet Reporting
 action.notable.param.security_domain = endpoint
 action.notable.param.severity = high
@@ -13493,10 +13493,10 @@ search = | tstats `security_content_summariesonly` count from datamodel=Endpoint
 [ESCU - Disable Defender Submit Samples Consent Feature - Rule]
 action.escu = 0
 action.escu.enabled = 1
-description = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the submit samples feature for further analysis..
+description = This analytic is intended to detect a suspicious modification of the Windows registry to disable a Windows Defender feature. This technique is intended to bypass or evade detection from Windows Defender AV, specifically the feature that submits samples for further analysis.
 action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
 action.escu.data_models = ["Endpoint"]
-action.escu.eli5 = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the submit samples feature for further analysis..
+action.escu.eli5 = This analytic is intended to detect a suspicious modification of the Windows registry to disable a Windows Defender feature. This technique is intended to bypass or evade detection from Windows Defender AV, specifically the feature that submits samples for further analysis.
 action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 action.escu.known_false_positives = admin or user may choose to disable windows defender product
 action.escu.creation_date = 2022-01-26
@@ -13506,7 +13506,7 @@ action.escu.full_search_name = ESCU - Disable Defender Submit Samples Consent Fe
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
-action.escu.analytic_story = ["IceID", "Windows Registry Abuse", "Azorult"]
+action.escu.analytic_story = ["IcedID", "Windows Registry Abuse", "Azorult"]
 action.risk = 1
 action.risk.param._risk_message = modified/added/deleted registry entry $Registry.registry_path$ in $dest$
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}]
@@ -13517,11 +13517,11 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Disable Defender Submit Samples Consent Feature - Rule
-action.correlationsearch.annotations = {"analytic_story": ["IceID", "Windows Registry Abuse", "Azorult"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
+action.correlationsearch.annotations = {"analytic_story": ["IcedID", "Windows Registry Abuse", "Azorult"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
-action.notable.param.rule_description = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the submit samples feature for further analysis..
+action.notable.param.rule_description = This analytic is intended to detect a suspicious modification of the Windows registry to disable a Windows Defender feature. This technique is intended to bypass or evade detection from Windows Defender AV, specifically the feature that submits samples for further analysis.
 action.notable.param.rule_title = Disable Defender Submit Samples Consent Feature
 action.notable.param.security_domain = endpoint
 action.notable.param.severity = high
@@ -13677,10 +13677,10 @@ search = | tstats `security_content_summariesonly` count from datamodel=Endpoint
 [ESCU - Disable Schedule Task - Rule]
 action.escu = 0
 action.escu.enabled = 1
-description = This analytic is to detect a suspicious commandline to disable existing schedule task. This technique is used by adversaries or commodity malware like IceID to disable security application (AV products) in the targetted host to evade detections. This TTP is a good pivot to check further why and what other process run before and after this detection. check which process execute the commandline and what task is disabled. parent child process is quite valuable in this scenario too.
+description = This analytic is to detect a suspicious commandline to disable existing schedule task. This technique is used by adversaries or commodity malware like IcedID to disable security application (AV products) in the targetted host to evade detections. This TTP is a good pivot to check further why and what other process run before and after this detection. check which process execute the commandline and what task is disabled. parent child process is quite valuable in this scenario too.
 action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
 action.escu.data_models = ["Endpoint"]
-action.escu.eli5 = This analytic is to detect a suspicious commandline to disable existing schedule task. This technique is used by adversaries or commodity malware like IceID to disable security application (AV products) in the targetted host to evade detections. This TTP is a good pivot to check further why and what other process run before and after this detection. check which process execute the commandline and what task is disabled. parent child process is quite valuable in this scenario too.
+action.escu.eli5 = This analytic is to detect a suspicious commandline to disable existing schedule task. This technique is used by adversaries or commodity malware like IcedID to disable security application (AV products) in the targetted host to evade detections. This TTP is a good pivot to check further why and what other process run before and after this detection. check which process execute the commandline and what task is disabled. parent child process is quite valuable in this scenario too.
 action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 action.escu.known_false_positives = admin may disable problematic schedule task
 action.escu.creation_date = 2021-10-18
@@ -13705,7 +13705,7 @@ action.correlationsearch.annotations = {"analytic_story": ["IcedID", "Living Off
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
-action.notable.param.rule_description = This analytic is to detect a suspicious commandline to disable existing schedule task. This technique is used by adversaries or commodity malware like IceID to disable security application (AV products) in the targetted host to evade detections. This TTP is a good pivot to check further why and what other process run before and after this detection. check which process execute the commandline and what task is disabled. parent child process is quite valuable in this scenario too.
+action.notable.param.rule_description = This analytic is to detect a suspicious commandline to disable existing schedule task. This technique is used by adversaries or commodity malware like IcedID to disable security application (AV products) in the targetted host to evade detections. This TTP is a good pivot to check further why and what other process run before and after this detection. check which process execute the commandline and what task is disabled. parent child process is quite valuable in this scenario too.
 action.notable.param.rule_title = Disable Schedule Task
 action.notable.param.security_domain = endpoint
 action.notable.param.severity = high
@@ -14196,7 +14196,7 @@ action.escu.full_search_name = ESCU - Disabling Defender Services - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
-action.escu.analytic_story = ["IceID", "Windows Registry Abuse"]
+action.escu.analytic_story = ["IcedID", "Windows Registry Abuse"]
 action.risk = 1
 action.risk.param._risk_message = modified/added/deleted registry entry $registry_path$ in $dest$
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}]
@@ -14207,7 +14207,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Disabling Defender Services - Rule
-action.correlationsearch.annotations = {"analytic_story": ["IceID", "Windows Registry Abuse"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
+action.correlationsearch.annotations = {"analytic_story": ["IcedID", "Windows Registry Abuse"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -31725,7 +31725,7 @@ action.escu.full_search_name = ESCU - Suspicious Regsvr32 Register Suspicious Pa
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
-action.escu.analytic_story = ["Suspicious Regsvr32 Activity", "Iceid", "Living Off The Land"]
+action.escu.analytic_story = ["Suspicious Regsvr32 Activity", "Icedid", "Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = Suspicious $Processes.process_path.file_path$ process potentially loading malicious code
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}, {"threat_object_field": "Processes.process_path.file_path", "threat_object_type": "file name"}]
@@ -31736,7 +31736,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Suspicious Regsvr32 Register Suspicious Path - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvr32 Activity", "Iceid", "Living Off The Land"], "cis20": ["CIS 8", "CIS 16"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.010"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Processes.process_path.file_path", "role": ["Attacker"], "type": "File Name"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvr32 Activity", "Icedid", "Living Off The Land"], "cis20": ["CIS 8", "CIS 16"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.010"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Processes.process_path.file_path", "role": ["Attacker"], "type": "File Name"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -31804,10 +31804,10 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime
 [ESCU - Suspicious Rundll32 PluginInit - Rule]
 action.escu = 0
 action.escu.enabled = 1
-description = This search is to detect a suspicious rundll32.exe process with plugininit parameter. This technique is commonly seen in IceID malware to execute its initial dll stager to download another payload to the compromised machine.
+description = This search is to detect a suspicious rundll32.exe process with plugininit parameter. This technique is commonly seen in IcedID malware to execute its initial dll stager to download another payload to the compromised machine.
 action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.011"]}
 action.escu.data_models = ["Endpoint"]
-action.escu.eli5 = This search is to detect a suspicious rundll32.exe process with plugininit parameter. This technique is commonly seen in IceID malware to execute its initial dll stager to download another payload to the compromised machine.
+action.escu.eli5 = This search is to detect a suspicious rundll32.exe process with plugininit parameter. This technique is commonly seen in IcedID malware to execute its initial dll stager to download another payload to the compromised machine.
 action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 action.escu.known_false_positives = third party application may used this dll export name to execute function.
 action.escu.creation_date = 2021-07-26
@@ -31832,7 +31832,7 @@ action.correlationsearch.annotations = {"analytic_story": ["IcedID"], "confidenc
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
-action.notable.param.rule_description = This search is to detect a suspicious rundll32.exe process with plugininit parameter. This technique is commonly seen in IceID malware to execute its initial dll stager to download another payload to the compromised machine.
+action.notable.param.rule_description = This search is to detect a suspicious rundll32.exe process with plugininit parameter. This technique is commonly seen in IcedID malware to execute its initial dll stager to download another payload to the compromised machine.
 action.notable.param.rule_title = Suspicious Rundll32 PluginInit
 action.notable.param.security_domain = endpoint
 action.notable.param.severity = high
@@ -34057,7 +34057,7 @@ action.escu.full_search_name = ESCU - Windows Curl Download to Suspicious Path -
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
-action.escu.analytic_story = ["IceID", "Ingress Tool Transfer"]
+action.escu.analytic_story = ["IcedID", "Ingress Tool Transfer"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ to download a file to a suspicious directory.
 action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
@@ -34068,7 +34068,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Windows Curl Download to Suspicious Path - Rule
-action.correlationsearch.annotations = {"analytic_story": ["IceID", "Ingress Tool Transfer"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1105"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
+action.correlationsearch.annotations = {"analytic_story": ["IcedID", "Ingress Tool Transfer"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1105"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -40124,10 +40124,10 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime
 [ESCU - Wmic NonInteractive App Uninstallation - Rule]
 action.escu = 0
 action.escu.enabled = 1
-description = This analytic indentifies WMIC command-line attempting to uninstall application non-interactively. This technique was seen in IceID to uninstall AV products on the compromised host to evade detection. This Hunting query maybe a good indicator that some process tries to uninstall application using wmic which is not a common behavior. This approach may seen in some script or third part appication to uninstall their application but it is a good thing to check what it uninstall and why.
+description = This analytic indentifies WMIC command-line attempting to uninstall application non-interactively. This technique was seen in IcedID to uninstall AV products on the compromised host to evade detection. This Hunting query maybe a good indicator that some process tries to uninstall application using wmic which is not a common behavior. This approach may seen in some script or third part appication to uninstall their application but it is a good thing to check what it uninstall and why.
 action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
 action.escu.data_models = ["Endpoint"]
-action.escu.eli5 = This analytic indentifies WMIC command-line attempting to uninstall application non-interactively. This technique was seen in IceID to uninstall AV products on the compromised host to evade detection. This Hunting query maybe a good indicator that some process tries to uninstall application using wmic which is not a common behavior. This approach may seen in some script or third part appication to uninstall their application but it is a good thing to check what it uninstall and why.
+action.escu.eli5 = This analytic indentifies WMIC command-line attempting to uninstall application non-interactively. This technique was seen in IcedID to uninstall AV products on the compromised host to evade detection. This Hunting query maybe a good indicator that some process tries to uninstall application using wmic which is not a common behavior. This approach may seen in some script or third part appication to uninstall their application but it is a good thing to check what it uninstall and why.
 action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 action.escu.known_false_positives = Third party application may use this approach to uninstall applications.
 action.escu.creation_date = 2022-07-19
@@ -40137,7 +40137,7 @@ action.escu.full_search_name = ESCU - Wmic NonInteractive App Uninstallation - R
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
-action.escu.analytic_story = ["IceID", "Azorult"]
+action.escu.analytic_story = ["IcedID", "Azorult"]
 action.risk = 1
 action.risk.param._risk_message = Wmic $process_name$ with command-line $process$ on $dest$ attempting to uninstall software.
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
@@ -40148,7 +40148,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Wmic NonInteractive App Uninstallation - Rule
-action.correlationsearch.annotations = {"analytic_story": ["IceID", "Azorult"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}, {"name": "process_name", "role": ["Target"], "type": "Process"}]}
+action.correlationsearch.annotations = {"analytic_story": ["IcedID", "Azorult"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}, {"name": "process_name", "role": ["Target"], "type": "Process"}]}
 schedule_window = auto
 alert.digest_mode = 1
 disabled = true
diff --git a/dist/escu/default/transforms.conf b/dist/escu/default/transforms.conf
index 6571546502..94a7b2c78d 100644
--- a/dist/escu/default/transforms.conf
+++ b/dist/escu/default/transforms.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-09-20T15:09:11 UTC
+# On Date: 2022-09-27T00:24:02 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
diff --git a/dist/escu/default/workflow_actions.conf b/dist/escu/default/workflow_actions.conf
index 82226aecc5..5651198f51 100644
--- a/dist/escu/default/workflow_actions.conf
+++ b/dist/escu/default/workflow_actions.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-09-20T15:09:11 UTC
+# On Date: 2022-09-27T00:24:02 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml
index 111da21cfc..6e7e5a60bd 100644
--- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml
+++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml
@@ -67,4 +67,4 @@ test:
     attack_data:
     - file_name: 4688_windows-security.log
       data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/4688_windows-security.log
-      source: WinEventLog:Security
+      source: XmlWinEventLog

From 84da3285a610a569ee930298944f401d21adf688 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Tue, 27 Sep 2022 10:29:23 -0700
Subject: [PATCH 02/10] Don't run detection testing on TAGs

---
 .github/workflows/detection-testing.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/detection-testing.yml b/.github/workflows/detection-testing.yml
index 087821ac77..9facd83432 100644
--- a/.github/workflows/detection-testing.yml
+++ b/.github/workflows/detection-testing.yml
@@ -41,6 +41,7 @@ jobs:
 
   docker-detection-testing-setup:
     runs-on: ubuntu-latest
+    if: if not contains('refs/tags/', github.ref) #don't run on tags - future steps won't run either since they depend on this job
     needs: [validate-tag-if-present, quit-for-dependabot]
     steps:  
         - name: Get branch and PR required for detection testing main.py

From 6019f90800693c053ccf39335495370da988597c Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Tue, 27 Sep 2022 10:31:00 -0700
Subject: [PATCH 03/10] syntax fix for don't run on tags

---
 .github/workflows/detection-testing.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/detection-testing.yml b/.github/workflows/detection-testing.yml
index 9facd83432..8378b2e2c7 100644
--- a/.github/workflows/detection-testing.yml
+++ b/.github/workflows/detection-testing.yml
@@ -41,7 +41,7 @@ jobs:
 
   docker-detection-testing-setup:
     runs-on: ubuntu-latest
-    if: if not contains('refs/tags/', github.ref) #don't run on tags - future steps won't run either since they depend on this job
+    if: not contains('refs/tags/', github.ref) #don't run on tags - future steps won't run either since they depend on this job
     needs: [validate-tag-if-present, quit-for-dependabot]
     steps:  
         - name: Get branch and PR required for detection testing main.py

From 197834b2b7ce2e40972f965fa01d1fd1e038be6a Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Tue, 27 Sep 2022 10:32:27 -0700
Subject: [PATCH 04/10] another fix to tag checking

---
 .github/workflows/detection-testing.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/detection-testing.yml b/.github/workflows/detection-testing.yml
index 8378b2e2c7..6075b4c934 100644
--- a/.github/workflows/detection-testing.yml
+++ b/.github/workflows/detection-testing.yml
@@ -41,7 +41,7 @@ jobs:
 
   docker-detection-testing-setup:
     runs-on: ubuntu-latest
-    if: not contains('refs/tags/', github.ref) #don't run on tags - future steps won't run either since they depend on this job
+    if: contains('refs/tags/', github.ref) != true #don't run on tags - future steps won't run either since they depend on this job
     needs: [validate-tag-if-present, quit-for-dependabot]
     steps:  
         - name: Get branch and PR required for detection testing main.py

From 88ba1e808034c6cf0467b935a254d8be922e6b30 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Tue, 27 Sep 2022 10:54:38 -0700
Subject: [PATCH 05/10] Fixing skip detection testing on tag

---
 .github/workflows/detection-testing.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/detection-testing.yml b/.github/workflows/detection-testing.yml
index 6075b4c934..1e20be2409 100644
--- a/.github/workflows/detection-testing.yml
+++ b/.github/workflows/detection-testing.yml
@@ -41,7 +41,7 @@ jobs:
 
   docker-detection-testing-setup:
     runs-on: ubuntu-latest
-    if: contains('refs/tags/', github.ref) != true #don't run on tags - future steps won't run either since they depend on this job
+    if: contains('/refs/tags/', github.ref) == false #don't run on tags - future steps won't run either since they depend on this job
     needs: [validate-tag-if-present, quit-for-dependabot]
     steps:  
         - name: Get branch and PR required for detection testing main.py
@@ -119,6 +119,7 @@ jobs:
 
   docker-detection-testing-execution:
     runs-on: ubuntu-latest
+    if: contains('/refs/tags/', github.ref) == false #don't run on tags - future steps won't run either since they depend on this job
     needs: [docker-detection-testing-setup]
     strategy:
       matrix:
@@ -190,6 +191,7 @@ jobs:
           
   docker-detection-testing-execution-merge-results:
     runs-on: ubuntu-latest
+    if: contains('/refs/tags/', github.ref) == false #don't run on tags - future steps won't run either since they depend on this job
     needs: [docker-detection-testing-setup, docker-detection-testing-execution]
  
     steps:  

From 8ee7196cf6941d9285b47a653de82f359c325820 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Tue, 27 Sep 2022 11:00:56 -0700
Subject: [PATCH 06/10] Fixed name from /refs/tag/ to refs/tag/

---
 .github/workflows/detection-testing.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/detection-testing.yml b/.github/workflows/detection-testing.yml
index 1e20be2409..534c269504 100644
--- a/.github/workflows/detection-testing.yml
+++ b/.github/workflows/detection-testing.yml
@@ -41,7 +41,7 @@ jobs:
 
   docker-detection-testing-setup:
     runs-on: ubuntu-latest
-    if: contains('/refs/tags/', github.ref) == false #don't run on tags - future steps won't run either since they depend on this job
+    if: contains('refs/tags/', github.ref) == false #don't run on tags - future steps won't run either since they depend on this job
     needs: [validate-tag-if-present, quit-for-dependabot]
     steps:  
         - name: Get branch and PR required for detection testing main.py
@@ -119,7 +119,7 @@ jobs:
 
   docker-detection-testing-execution:
     runs-on: ubuntu-latest
-    if: contains('/refs/tags/', github.ref) == false #don't run on tags - future steps won't run either since they depend on this job
+    if: contains('refs/tags/', github.ref) == false #don't run on tags - future steps won't run either since they depend on this job
     needs: [docker-detection-testing-setup]
     strategy:
       matrix:
@@ -191,7 +191,7 @@ jobs:
           
   docker-detection-testing-execution-merge-results:
     runs-on: ubuntu-latest
-    if: contains('/refs/tags/', github.ref) == false #don't run on tags - future steps won't run either since they depend on this job
+    if: contains('refs/tags/', github.ref) == false #don't run on tags - future steps won't run either since they depend on this job
     needs: [docker-detection-testing-setup, docker-detection-testing-execution]
  
     steps:  

From 171edbe9a5a62f15bfef0d742513ae28110a5bda Mon Sep 17 00:00:00 2001
From: research bot <research@splunk.com>
Date: Tue, 27 Sep 2022 18:11:16 +0000
Subject: [PATCH 07/10] updating docs and package bits [ci skip]

---
 dist/escu/app.manifest                        |  2 +-
 dist/escu/default/analyticstories.conf        | 22 ++---
 dist/escu/default/app.conf                    |  4 +-
 dist/escu/default/collections.conf            |  2 +-
 dist/escu/default/content-version.conf        |  2 +-
 dist/escu/default/es_investigations.conf      |  2 +-
 dist/escu/default/macros.conf                 |  2 +-
 dist/escu/default/savedsearches.conf          | 94 +++++++++----------
 dist/escu/default/transforms.conf             |  2 +-
 dist/escu/default/workflow_actions.conf       |  2 +-
 ...execution_compiled_html_file_decompile.yml |  2 +-
 11 files changed, 68 insertions(+), 68 deletions(-)

diff --git a/dist/escu/app.manifest b/dist/escu/app.manifest
index 55abc3f4fb..bb586751ff 100644
--- a/dist/escu/app.manifest
+++ b/dist/escu/app.manifest
@@ -5,7 +5,7 @@
     "id": {
       "group": null, 
       "name": "DA-ESS-ContentUpdate", 
-      "version": "3.49.1"
+      "version": "0.0.000001"
     }, 
     "author": [
       {
diff --git a/dist/escu/default/analyticstories.conf b/dist/escu/default/analyticstories.conf
index 32671a12bc..3c61bf79ab 100644
--- a/dist/escu/default/analyticstories.conf
+++ b/dist/escu/default/analyticstories.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-09-27T00:24:02 UTC
+# On Date: 2022-09-27T18:03:17 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -3115,7 +3115,7 @@ providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response"
 type = detection
 asset_type = Endpoint
 confidence = medium
-explanation = This particular behavior is typically executed when an adversary or malware gains access to an endpoint and begins to perform execution and to evade detections. Usually, a batch (.bat) file will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated.
+explanation = This particular behavior is typically executed when an adversaries or malware gains access to an endpoint and beings to perform execution and to evade detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated.
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
 known_false_positives = admin or user may choose to disable windows defender product
@@ -3125,7 +3125,7 @@ providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response"
 type = detection
 asset_type = Endpoint
 confidence = medium
-explanation = This analytic is intended to detect a suspicious modification of the Windows registry to disable a Windows Defender feature. This technique is intended to bypass or evade detection from Windows Defender AV, specifically the BlockAtFirstSeen feature where it blocks suspicious files the first time seen on the host.
+explanation = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the BlockAtFirstSeen feature where it block suspicious file first seen in the host.
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
 known_false_positives = admin or user may choose to disable windows defender product
@@ -3135,7 +3135,7 @@ providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response"
 type = detection
 asset_type = Endpoint
 confidence = medium
-explanation = This analytic is intended to detect a suspicious modification of registry to disable windows defender features. This technique attempts to bypass or evade detection from Windows Defender AV, specifically the Enhanced Notification feature where a user or admin would receive alerts.
+explanation = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the Enhanced Notification feature wher user or admin set to show or display alerts.
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
 known_false_positives = user may choose to disable windows defender AV
@@ -3145,7 +3145,7 @@ providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response"
 type = detection
 asset_type = Endpoint
 confidence = medium
-explanation = This particular behavior is typically executed when an adversary or malware gains access to an endpoint and begins to perform execution and to evade detections. Usually, a batch (.bat) file will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated.
+explanation = This particular behavior is typically executed when an adversaries or malware gains access to an endpoint and beings to perform execution and to evade detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated.
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
 known_false_positives = admin or user may choose to disable windows defender product
@@ -3155,7 +3155,7 @@ providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response"
 type = detection
 asset_type = Endpoint
 confidence = medium
-explanation = This analytic is intended to detect a suspicious modification of registry to disable Windows Defender feature. This technique is intended to bypass or evade detection from Windows Defender AV product, specifically the spynet reporting for Defender telemetry.
+explanation = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the spynet reporting for its telemetry.
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
 known_false_positives = admin or user may choose to disable windows defender product
@@ -3165,7 +3165,7 @@ providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response"
 type = detection
 asset_type = Endpoint
 confidence = medium
-explanation = This analytic is intended to detect a suspicious modification of the Windows registry to disable a Windows Defender feature. This technique is intended to bypass or evade detection from Windows Defender AV, specifically the feature that submits samples for further analysis.
+explanation = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the submit samples feature for further analysis..
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
 known_false_positives = admin or user may choose to disable windows defender product
@@ -3205,7 +3205,7 @@ providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response"
 type = detection
 asset_type = Endpoint
 confidence = medium
-explanation = This analytic is to detect a suspicious commandline to disable existing schedule task. This technique is used by adversaries or commodity malware like IcedID to disable security application (AV products) in the targetted host to evade detections. This TTP is a good pivot to check further why and what other process run before and after this detection. check which process execute the commandline and what task is disabled. parent child process is quite valuable in this scenario too.
+explanation = This analytic is to detect a suspicious commandline to disable existing schedule task. This technique is used by adversaries or commodity malware like IceID to disable security application (AV products) in the targetted host to evade detections. This TTP is a good pivot to check further why and what other process run before and after this detection. check which process execute the commandline and what task is disabled. parent child process is quite valuable in this scenario too.
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
 known_false_positives = admin may disable problematic schedule task
@@ -7388,7 +7388,7 @@ providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response"
 type = detection
 asset_type = Endpoint
 confidence = medium
-explanation = This search is to detect a suspicious rundll32.exe process with plugininit parameter. This technique is commonly seen in IcedID malware to execute its initial dll stager to download another payload to the compromised machine.
+explanation = This search is to detect a suspicious rundll32.exe process with plugininit parameter. This technique is commonly seen in IceID malware to execute its initial dll stager to download another payload to the compromised machine.
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.011"]}
 known_false_positives = third party application may used this dll export name to execute function.
@@ -9314,7 +9314,7 @@ providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response"
 type = detection
 asset_type = Endpoint
 confidence = medium
-explanation = This analytic indentifies WMIC command-line attempting to uninstall application non-interactively. This technique was seen in IcedID to uninstall AV products on the compromised host to evade detection. This Hunting query maybe a good indicator that some process tries to uninstall application using wmic which is not a common behavior. This approach may seen in some script or third part appication to uninstall their application but it is a good thing to check what it uninstall and why.
+explanation = This analytic indentifies WMIC command-line attempting to uninstall application non-interactively. This technique was seen in IceID to uninstall AV products on the compromised host to evade detection. This Hunting query maybe a good indicator that some process tries to uninstall application using wmic which is not a common behavior. This approach may seen in some script or third part appication to uninstall their application but it is a good thing to check what it uninstall and why.
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
 known_false_positives = Third party application may use this approach to uninstall applications.
@@ -10613,7 +10613,7 @@ version = 1
 references = ["https://threatpost.com/icedid-banking-trojan-surges-emotet/165314/", "https://app.any.run/tasks/48414a33-3d66-4a46-afe5-c2003bb55ccf/"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Teoderick Contreras"}]
 spec_version = 3
-searches = ["ESCU - Account Discovery With Net App - Rule", "ESCU - CHCP Command Execution - Rule", "ESCU - CMD Carry Out String Command Parameter - Rule", "ESCU - Create Remote Thread In Shell Application - Rule", "ESCU - Disable Defender AntiVirus Registry - Rule", "ESCU - Disable Defender BlockAtFirstSeen Feature - Rule", "ESCU - Disable Defender Enhanced Notification - Rule", "ESCU - Disable Defender MpEngine Registry - Rule", "ESCU - Disable Defender Spynet Reporting - Rule", "ESCU - Disable Defender Submit Samples Consent Feature - Rule", "ESCU - Disable Schedule Task - Rule", "ESCU - Disabling Defender Services - Rule", "ESCU - Drop IcedID License dat - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - IcedID Exfiltrated Archived File Creation - Rule", "ESCU - Mshta spawning Rundll32 OR Regsvr32 Process - Rule", "ESCU - NLTest Domain Trust Discovery - Rule", "ESCU - Office Application Spawn Regsvr32 process - Rule", "ESCU - Office Application Spawn rundll32 process - Rule", "ESCU - Office Document Executing Macro Code - Rule", "ESCU - Office Product Spawning MSHTA - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Regsvr32 with Known Silent Switch Cmdline - Rule", "ESCU - Rundll32 Create Remote Thread To A Process - Rule", "ESCU - Rundll32 CreateRemoteThread In Browser - Rule", "ESCU - Rundll32 DNSQuery - Rule", "ESCU - Rundll32 Process Creating Exe Dll Files - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Sqlite Module In Temp Folder - Rule", "ESCU - Suspicious IcedID Rundll32 Cmdline - Rule", "ESCU - Suspicious Rundll32 PluginInit - Rule", "ESCU - Windows Curl Download to Suspicious Path - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Windows Task Scheduler Event Action Started - Rule", "ESCU - Wmic NonInteractive App Uninstallation - Rule"]
+searches = ["ESCU - Account Discovery With Net App - Rule", "ESCU - CHCP Command Execution - Rule", "ESCU - CMD Carry Out String Command Parameter - Rule", "ESCU - Create Remote Thread In Shell Application - Rule", "ESCU - Disable Schedule Task - Rule", "ESCU - Drop IcedID License dat - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - IcedID Exfiltrated Archived File Creation - Rule", "ESCU - Mshta spawning Rundll32 OR Regsvr32 Process - Rule", "ESCU - NLTest Domain Trust Discovery - Rule", "ESCU - Office Application Spawn Regsvr32 process - Rule", "ESCU - Office Application Spawn rundll32 process - Rule", "ESCU - Office Document Executing Macro Code - Rule", "ESCU - Office Product Spawning MSHTA - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Regsvr32 with Known Silent Switch Cmdline - Rule", "ESCU - Rundll32 Create Remote Thread To A Process - Rule", "ESCU - Rundll32 CreateRemoteThread In Browser - Rule", "ESCU - Rundll32 DNSQuery - Rule", "ESCU - Rundll32 Process Creating Exe Dll Files - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Sqlite Module In Temp Folder - Rule", "ESCU - Suspicious IcedID Rundll32 Cmdline - Rule", "ESCU - Suspicious Rundll32 PluginInit - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Windows Task Scheduler Event Action Started - Rule"]
 description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the IcedID banking trojan, including looking for file writes associated with its payload, process injection, shellcode execution and data collection.
 narrative = IcedId banking trojan campaigns targeting banks and other vertical sectors.This malware is known in Microsoft Windows OS targetting browser such as firefox and chrom to steal banking information. It is also known to its unique payload downloaded in C2 where it can be a .png file that hides the core shellcode bot using steganography technique or gzip dat file that contains "license.dat" which is the actual core icedid bot.
 
diff --git a/dist/escu/default/app.conf b/dist/escu/default/app.conf
index 561a2c458c..ba06fcf038 100644
--- a/dist/escu/default/app.conf
+++ b/dist/escu/default/app.conf
@@ -4,7 +4,7 @@
 is_configured = false
 state = enabled
 state_change_requires_restart = false
-build = 10110
+build = 10120
 
 [triggers]
 reload.analytic_stories = simple
@@ -20,7 +20,7 @@ reload.es_investigations = simple
 
 [launcher]
 author = Splunk
-version = 3.49.1
+version = 0.0.000001
 description = Explore the Analytic Stories included with ES Content Updates.
 
 [ui]
diff --git a/dist/escu/default/collections.conf b/dist/escu/default/collections.conf
index d879e9f567..01b1163a2e 100644
--- a/dist/escu/default/collections.conf
+++ b/dist/escu/default/collections.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-09-27T00:24:02 UTC
+# On Date: 2022-09-27T18:03:17 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
diff --git a/dist/escu/default/content-version.conf b/dist/escu/default/content-version.conf
index fd1c542b7a..8159091eff 100644
--- a/dist/escu/default/content-version.conf
+++ b/dist/escu/default/content-version.conf
@@ -1,2 +1,2 @@
 [content-version]
-version = 3.49.1
+version = 0.0.000001
diff --git a/dist/escu/default/es_investigations.conf b/dist/escu/default/es_investigations.conf
index c766e23275..1a4ab96070 100644
--- a/dist/escu/default/es_investigations.conf
+++ b/dist/escu/default/es_investigations.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-09-27T00:24:02 UTC
+# On Date: 2022-09-27T18:03:17 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
diff --git a/dist/escu/default/macros.conf b/dist/escu/default/macros.conf
index acc3de0097..22e9d8f997 100644
--- a/dist/escu/default/macros.conf
+++ b/dist/escu/default/macros.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-09-27T00:24:02 UTC
+# On Date: 2022-09-27T18:03:17 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
diff --git a/dist/escu/default/savedsearches.conf b/dist/escu/default/savedsearches.conf
index f2988eb6eb..b97d5bf64c 100644
--- a/dist/escu/default/savedsearches.conf
+++ b/dist/escu/default/savedsearches.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-09-27T00:24:02 UTC
+# On Date: 2022-09-27T18:03:17 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -13263,10 +13263,10 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime
 [ESCU - Disable Defender AntiVirus Registry - Rule]
 action.escu = 0
 action.escu.enabled = 1
-description = This particular behavior is typically executed when an adversary or malware gains access to an endpoint and begins to perform execution and to evade detections. Usually, a batch (.bat) file will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated.
+description = This particular behavior is typically executed when an adversaries or malware gains access to an endpoint and beings to perform execution and to evade detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated.
 action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
 action.escu.data_models = ["Endpoint"]
-action.escu.eli5 = This particular behavior is typically executed when an adversary or malware gains access to an endpoint and begins to perform execution and to evade detections. Usually, a batch (.bat) file will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated.
+action.escu.eli5 = This particular behavior is typically executed when an adversaries or malware gains access to an endpoint and beings to perform execution and to evade detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated.
 action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 action.escu.known_false_positives = admin or user may choose to disable windows defender product
 action.escu.creation_date = 2022-01-26
@@ -13276,7 +13276,7 @@ action.escu.full_search_name = ESCU - Disable Defender AntiVirus Registry - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
-action.escu.analytic_story = ["IcedID", "Windows Registry Abuse"]
+action.escu.analytic_story = ["IceID", "Windows Registry Abuse"]
 action.risk = 1
 action.risk.param._risk_message = modified/added/deleted registry entry $registry_path$ in $dest$
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}]
@@ -13287,11 +13287,11 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Disable Defender AntiVirus Registry - Rule
-action.correlationsearch.annotations = {"analytic_story": ["IcedID", "Windows Registry Abuse"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
+action.correlationsearch.annotations = {"analytic_story": ["IceID", "Windows Registry Abuse"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
-action.notable.param.rule_description = This particular behavior is typically executed when an adversary or malware gains access to an endpoint and begins to perform execution and to evade detections. Usually, a batch (.bat) file will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated.
+action.notable.param.rule_description = This particular behavior is typically executed when an adversaries or malware gains access to an endpoint and beings to perform execution and to evade detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated.
 action.notable.param.rule_title = Disable Defender AntiVirus Registry
 action.notable.param.security_domain = endpoint
 action.notable.param.severity = high
@@ -13309,10 +13309,10 @@ search = | tstats `security_content_summariesonly` count from datamodel=Endpoint
 [ESCU - Disable Defender BlockAtFirstSeen Feature - Rule]
 action.escu = 0
 action.escu.enabled = 1
-description = This analytic is intended to detect a suspicious modification of the Windows registry to disable a Windows Defender feature. This technique is intended to bypass or evade detection from Windows Defender AV, specifically the BlockAtFirstSeen feature where it blocks suspicious files the first time seen on the host.
+description = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the BlockAtFirstSeen feature where it block suspicious file first seen in the host.
 action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
 action.escu.data_models = ["Endpoint"]
-action.escu.eli5 = This analytic is intended to detect a suspicious modification of the Windows registry to disable a Windows Defender feature. This technique is intended to bypass or evade detection from Windows Defender AV, specifically the BlockAtFirstSeen feature where it blocks suspicious files the first time seen on the host.
+action.escu.eli5 = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the BlockAtFirstSeen feature where it block suspicious file first seen in the host.
 action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 action.escu.known_false_positives = admin or user may choose to disable windows defender product
 action.escu.creation_date = 2022-01-26
@@ -13322,7 +13322,7 @@ action.escu.full_search_name = ESCU - Disable Defender BlockAtFirstSeen Feature
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
-action.escu.analytic_story = ["IcedID", "Windows Registry Abuse", "Azorult"]
+action.escu.analytic_story = ["IceID", "Windows Registry Abuse", "Azorult"]
 action.risk = 1
 action.risk.param._risk_message = modified/added/deleted registry entry $registry_path$ in $dest$
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}]
@@ -13333,11 +13333,11 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Disable Defender BlockAtFirstSeen Feature - Rule
-action.correlationsearch.annotations = {"analytic_story": ["IcedID", "Windows Registry Abuse", "Azorult"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
+action.correlationsearch.annotations = {"analytic_story": ["IceID", "Windows Registry Abuse", "Azorult"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
-action.notable.param.rule_description = This analytic is intended to detect a suspicious modification of the Windows registry to disable a Windows Defender feature. This technique is intended to bypass or evade detection from Windows Defender AV, specifically the BlockAtFirstSeen feature where it blocks suspicious files the first time seen on the host.
+action.notable.param.rule_description = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the BlockAtFirstSeen feature where it block suspicious file first seen in the host.
 action.notable.param.rule_title = Disable Defender BlockAtFirstSeen Feature
 action.notable.param.security_domain = endpoint
 action.notable.param.severity = high
@@ -13355,10 +13355,10 @@ search = | tstats `security_content_summariesonly` count from datamodel=Endpoint
 [ESCU - Disable Defender Enhanced Notification - Rule]
 action.escu = 0
 action.escu.enabled = 1
-description = This analytic is intended to detect a suspicious modification of registry to disable windows defender features. This technique attempts to bypass or evade detection from Windows Defender AV, specifically the Enhanced Notification feature where a user or admin would receive alerts.
+description = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the Enhanced Notification feature wher user or admin set to show or display alerts.
 action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
 action.escu.data_models = ["Endpoint"]
-action.escu.eli5 = This analytic is intended to detect a suspicious modification of registry to disable windows defender features. This technique attempts to bypass or evade detection from Windows Defender AV, specifically the Enhanced Notification feature where a user or admin would receive alerts.
+action.escu.eli5 = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the Enhanced Notification feature wher user or admin set to show or display alerts.
 action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 action.escu.known_false_positives = user may choose to disable windows defender AV
 action.escu.creation_date = 2022-01-26
@@ -13368,7 +13368,7 @@ action.escu.full_search_name = ESCU - Disable Defender Enhanced Notification - R
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
-action.escu.analytic_story = ["IcedID", "Windows Registry Abuse", "Azorult"]
+action.escu.analytic_story = ["IceID", "Windows Registry Abuse", "Azorult"]
 action.risk = 1
 action.risk.param._risk_message = modified/added/deleted registry entry $registry_path$ in $dest$
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}]
@@ -13379,11 +13379,11 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Disable Defender Enhanced Notification - Rule
-action.correlationsearch.annotations = {"analytic_story": ["IcedID", "Windows Registry Abuse", "Azorult"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
+action.correlationsearch.annotations = {"analytic_story": ["IceID", "Windows Registry Abuse", "Azorult"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
-action.notable.param.rule_description = This analytic is intended to detect a suspicious modification of registry to disable windows defender features. This technique attempts to bypass or evade detection from Windows Defender AV, specifically the Enhanced Notification feature where a user or admin would receive alerts.
+action.notable.param.rule_description = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the Enhanced Notification feature wher user or admin set to show or display alerts.
 action.notable.param.rule_title = Disable Defender Enhanced Notification
 action.notable.param.security_domain = endpoint
 action.notable.param.severity = high
@@ -13401,10 +13401,10 @@ search = | tstats `security_content_summariesonly` count from datamodel=Endpoint
 [ESCU - Disable Defender MpEngine Registry - Rule]
 action.escu = 0
 action.escu.enabled = 1
-description = This particular behavior is typically executed when an adversary or malware gains access to an endpoint and begins to perform execution and to evade detections. Usually, a batch (.bat) file will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated.
+description = This particular behavior is typically executed when an adversaries or malware gains access to an endpoint and beings to perform execution and to evade detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated.
 action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
 action.escu.data_models = ["Endpoint"]
-action.escu.eli5 = This particular behavior is typically executed when an adversary or malware gains access to an endpoint and begins to perform execution and to evade detections. Usually, a batch (.bat) file will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated.
+action.escu.eli5 = This particular behavior is typically executed when an adversaries or malware gains access to an endpoint and beings to perform execution and to evade detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated.
 action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 action.escu.known_false_positives = admin or user may choose to disable windows defender product
 action.escu.creation_date = 2022-01-26
@@ -13414,7 +13414,7 @@ action.escu.full_search_name = ESCU - Disable Defender MpEngine Registry - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
-action.escu.analytic_story = ["IcedID", "Windows Registry Abuse"]
+action.escu.analytic_story = ["IceID", "Windows Registry Abuse"]
 action.risk = 1
 action.risk.param._risk_message = modified/added/deleted registry entry $registry_path$ in $dest$
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}]
@@ -13425,11 +13425,11 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Disable Defender MpEngine Registry - Rule
-action.correlationsearch.annotations = {"analytic_story": ["IcedID", "Windows Registry Abuse"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
+action.correlationsearch.annotations = {"analytic_story": ["IceID", "Windows Registry Abuse"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
-action.notable.param.rule_description = This particular behavior is typically executed when an adversary or malware gains access to an endpoint and begins to perform execution and to evade detections. Usually, a batch (.bat) file will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated.
+action.notable.param.rule_description = This particular behavior is typically executed when an adversaries or malware gains access to an endpoint and beings to perform execution and to evade detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled task modifications will occur. During triage, review parallel processes and identify any further file modifications. Endpoint should be isolated.
 action.notable.param.rule_title = Disable Defender MpEngine Registry
 action.notable.param.security_domain = endpoint
 action.notable.param.severity = high
@@ -13447,10 +13447,10 @@ search = | tstats `security_content_summariesonly` count from datamodel=Endpoint
 [ESCU - Disable Defender Spynet Reporting - Rule]
 action.escu = 0
 action.escu.enabled = 1
-description = This analytic is intended to detect a suspicious modification of registry to disable Windows Defender feature. This technique is intended to bypass or evade detection from Windows Defender AV product, specifically the spynet reporting for Defender telemetry.
+description = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the spynet reporting for its telemetry.
 action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
 action.escu.data_models = ["Endpoint"]
-action.escu.eli5 = This analytic is intended to detect a suspicious modification of registry to disable Windows Defender feature. This technique is intended to bypass or evade detection from Windows Defender AV product, specifically the spynet reporting for Defender telemetry.
+action.escu.eli5 = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the spynet reporting for its telemetry.
 action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 action.escu.known_false_positives = admin or user may choose to disable windows defender product
 action.escu.creation_date = 2022-01-26
@@ -13460,7 +13460,7 @@ action.escu.full_search_name = ESCU - Disable Defender Spynet Reporting - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
-action.escu.analytic_story = ["IcedID", "Windows Registry Abuse", "Azorult"]
+action.escu.analytic_story = ["IceID", "Windows Registry Abuse", "Azorult"]
 action.risk = 1
 action.risk.param._risk_message = modified/added/deleted registry entry $registry_path$ in $dest$
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}]
@@ -13471,11 +13471,11 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Disable Defender Spynet Reporting - Rule
-action.correlationsearch.annotations = {"analytic_story": ["IcedID", "Windows Registry Abuse", "Azorult"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
+action.correlationsearch.annotations = {"analytic_story": ["IceID", "Windows Registry Abuse", "Azorult"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
-action.notable.param.rule_description = This analytic is intended to detect a suspicious modification of registry to disable Windows Defender feature. This technique is intended to bypass or evade detection from Windows Defender AV product, specifically the spynet reporting for Defender telemetry.
+action.notable.param.rule_description = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the spynet reporting for its telemetry.
 action.notable.param.rule_title = Disable Defender Spynet Reporting
 action.notable.param.security_domain = endpoint
 action.notable.param.severity = high
@@ -13493,10 +13493,10 @@ search = | tstats `security_content_summariesonly` count from datamodel=Endpoint
 [ESCU - Disable Defender Submit Samples Consent Feature - Rule]
 action.escu = 0
 action.escu.enabled = 1
-description = This analytic is intended to detect a suspicious modification of the Windows registry to disable a Windows Defender feature. This technique is intended to bypass or evade detection from Windows Defender AV, specifically the feature that submits samples for further analysis.
+description = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the submit samples feature for further analysis..
 action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
 action.escu.data_models = ["Endpoint"]
-action.escu.eli5 = This analytic is intended to detect a suspicious modification of the Windows registry to disable a Windows Defender feature. This technique is intended to bypass or evade detection from Windows Defender AV, specifically the feature that submits samples for further analysis.
+action.escu.eli5 = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the submit samples feature for further analysis..
 action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 action.escu.known_false_positives = admin or user may choose to disable windows defender product
 action.escu.creation_date = 2022-01-26
@@ -13506,7 +13506,7 @@ action.escu.full_search_name = ESCU - Disable Defender Submit Samples Consent Fe
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
-action.escu.analytic_story = ["IcedID", "Windows Registry Abuse", "Azorult"]
+action.escu.analytic_story = ["IceID", "Windows Registry Abuse", "Azorult"]
 action.risk = 1
 action.risk.param._risk_message = modified/added/deleted registry entry $Registry.registry_path$ in $dest$
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}]
@@ -13517,11 +13517,11 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Disable Defender Submit Samples Consent Feature - Rule
-action.correlationsearch.annotations = {"analytic_story": ["IcedID", "Windows Registry Abuse", "Azorult"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
+action.correlationsearch.annotations = {"analytic_story": ["IceID", "Windows Registry Abuse", "Azorult"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
-action.notable.param.rule_description = This analytic is intended to detect a suspicious modification of the Windows registry to disable a Windows Defender feature. This technique is intended to bypass or evade detection from Windows Defender AV, specifically the feature that submits samples for further analysis.
+action.notable.param.rule_description = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the submit samples feature for further analysis..
 action.notable.param.rule_title = Disable Defender Submit Samples Consent Feature
 action.notable.param.security_domain = endpoint
 action.notable.param.severity = high
@@ -13677,10 +13677,10 @@ search = | tstats `security_content_summariesonly` count from datamodel=Endpoint
 [ESCU - Disable Schedule Task - Rule]
 action.escu = 0
 action.escu.enabled = 1
-description = This analytic is to detect a suspicious commandline to disable existing schedule task. This technique is used by adversaries or commodity malware like IcedID to disable security application (AV products) in the targetted host to evade detections. This TTP is a good pivot to check further why and what other process run before and after this detection. check which process execute the commandline and what task is disabled. parent child process is quite valuable in this scenario too.
+description = This analytic is to detect a suspicious commandline to disable existing schedule task. This technique is used by adversaries or commodity malware like IceID to disable security application (AV products) in the targetted host to evade detections. This TTP is a good pivot to check further why and what other process run before and after this detection. check which process execute the commandline and what task is disabled. parent child process is quite valuable in this scenario too.
 action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
 action.escu.data_models = ["Endpoint"]
-action.escu.eli5 = This analytic is to detect a suspicious commandline to disable existing schedule task. This technique is used by adversaries or commodity malware like IcedID to disable security application (AV products) in the targetted host to evade detections. This TTP is a good pivot to check further why and what other process run before and after this detection. check which process execute the commandline and what task is disabled. parent child process is quite valuable in this scenario too.
+action.escu.eli5 = This analytic is to detect a suspicious commandline to disable existing schedule task. This technique is used by adversaries or commodity malware like IceID to disable security application (AV products) in the targetted host to evade detections. This TTP is a good pivot to check further why and what other process run before and after this detection. check which process execute the commandline and what task is disabled. parent child process is quite valuable in this scenario too.
 action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 action.escu.known_false_positives = admin may disable problematic schedule task
 action.escu.creation_date = 2021-10-18
@@ -13705,7 +13705,7 @@ action.correlationsearch.annotations = {"analytic_story": ["IcedID", "Living Off
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
-action.notable.param.rule_description = This analytic is to detect a suspicious commandline to disable existing schedule task. This technique is used by adversaries or commodity malware like IcedID to disable security application (AV products) in the targetted host to evade detections. This TTP is a good pivot to check further why and what other process run before and after this detection. check which process execute the commandline and what task is disabled. parent child process is quite valuable in this scenario too.
+action.notable.param.rule_description = This analytic is to detect a suspicious commandline to disable existing schedule task. This technique is used by adversaries or commodity malware like IceID to disable security application (AV products) in the targetted host to evade detections. This TTP is a good pivot to check further why and what other process run before and after this detection. check which process execute the commandline and what task is disabled. parent child process is quite valuable in this scenario too.
 action.notable.param.rule_title = Disable Schedule Task
 action.notable.param.security_domain = endpoint
 action.notable.param.severity = high
@@ -14196,7 +14196,7 @@ action.escu.full_search_name = ESCU - Disabling Defender Services - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
-action.escu.analytic_story = ["IcedID", "Windows Registry Abuse"]
+action.escu.analytic_story = ["IceID", "Windows Registry Abuse"]
 action.risk = 1
 action.risk.param._risk_message = modified/added/deleted registry entry $registry_path$ in $dest$
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}]
@@ -14207,7 +14207,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Disabling Defender Services - Rule
-action.correlationsearch.annotations = {"analytic_story": ["IcedID", "Windows Registry Abuse"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
+action.correlationsearch.annotations = {"analytic_story": ["IceID", "Windows Registry Abuse"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -31725,7 +31725,7 @@ action.escu.full_search_name = ESCU - Suspicious Regsvr32 Register Suspicious Pa
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
-action.escu.analytic_story = ["Suspicious Regsvr32 Activity", "Icedid", "Living Off The Land"]
+action.escu.analytic_story = ["Suspicious Regsvr32 Activity", "Iceid", "Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = Suspicious $Processes.process_path.file_path$ process potentially loading malicious code
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}, {"threat_object_field": "Processes.process_path.file_path", "threat_object_type": "file name"}]
@@ -31736,7 +31736,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Suspicious Regsvr32 Register Suspicious Path - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvr32 Activity", "Icedid", "Living Off The Land"], "cis20": ["CIS 8", "CIS 16"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.010"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Processes.process_path.file_path", "role": ["Attacker"], "type": "File Name"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvr32 Activity", "Iceid", "Living Off The Land"], "cis20": ["CIS 8", "CIS 16"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.010"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Processes.process_path.file_path", "role": ["Attacker"], "type": "File Name"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -31804,10 +31804,10 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime
 [ESCU - Suspicious Rundll32 PluginInit - Rule]
 action.escu = 0
 action.escu.enabled = 1
-description = This search is to detect a suspicious rundll32.exe process with plugininit parameter. This technique is commonly seen in IcedID malware to execute its initial dll stager to download another payload to the compromised machine.
+description = This search is to detect a suspicious rundll32.exe process with plugininit parameter. This technique is commonly seen in IceID malware to execute its initial dll stager to download another payload to the compromised machine.
 action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.011"]}
 action.escu.data_models = ["Endpoint"]
-action.escu.eli5 = This search is to detect a suspicious rundll32.exe process with plugininit parameter. This technique is commonly seen in IcedID malware to execute its initial dll stager to download another payload to the compromised machine.
+action.escu.eli5 = This search is to detect a suspicious rundll32.exe process with plugininit parameter. This technique is commonly seen in IceID malware to execute its initial dll stager to download another payload to the compromised machine.
 action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 action.escu.known_false_positives = third party application may used this dll export name to execute function.
 action.escu.creation_date = 2021-07-26
@@ -31832,7 +31832,7 @@ action.correlationsearch.annotations = {"analytic_story": ["IcedID"], "confidenc
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
-action.notable.param.rule_description = This search is to detect a suspicious rundll32.exe process with plugininit parameter. This technique is commonly seen in IcedID malware to execute its initial dll stager to download another payload to the compromised machine.
+action.notable.param.rule_description = This search is to detect a suspicious rundll32.exe process with plugininit parameter. This technique is commonly seen in IceID malware to execute its initial dll stager to download another payload to the compromised machine.
 action.notable.param.rule_title = Suspicious Rundll32 PluginInit
 action.notable.param.security_domain = endpoint
 action.notable.param.severity = high
@@ -34057,7 +34057,7 @@ action.escu.full_search_name = ESCU - Windows Curl Download to Suspicious Path -
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
-action.escu.analytic_story = ["IcedID", "Ingress Tool Transfer"]
+action.escu.analytic_story = ["IceID", "Ingress Tool Transfer"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ to download a file to a suspicious directory.
 action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
@@ -34068,7 +34068,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Windows Curl Download to Suspicious Path - Rule
-action.correlationsearch.annotations = {"analytic_story": ["IcedID", "Ingress Tool Transfer"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1105"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
+action.correlationsearch.annotations = {"analytic_story": ["IceID", "Ingress Tool Transfer"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1105"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -40124,10 +40124,10 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime
 [ESCU - Wmic NonInteractive App Uninstallation - Rule]
 action.escu = 0
 action.escu.enabled = 1
-description = This analytic indentifies WMIC command-line attempting to uninstall application non-interactively. This technique was seen in IcedID to uninstall AV products on the compromised host to evade detection. This Hunting query maybe a good indicator that some process tries to uninstall application using wmic which is not a common behavior. This approach may seen in some script or third part appication to uninstall their application but it is a good thing to check what it uninstall and why.
+description = This analytic indentifies WMIC command-line attempting to uninstall application non-interactively. This technique was seen in IceID to uninstall AV products on the compromised host to evade detection. This Hunting query maybe a good indicator that some process tries to uninstall application using wmic which is not a common behavior. This approach may seen in some script or third part appication to uninstall their application but it is a good thing to check what it uninstall and why.
 action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
 action.escu.data_models = ["Endpoint"]
-action.escu.eli5 = This analytic indentifies WMIC command-line attempting to uninstall application non-interactively. This technique was seen in IcedID to uninstall AV products on the compromised host to evade detection. This Hunting query maybe a good indicator that some process tries to uninstall application using wmic which is not a common behavior. This approach may seen in some script or third part appication to uninstall their application but it is a good thing to check what it uninstall and why.
+action.escu.eli5 = This analytic indentifies WMIC command-line attempting to uninstall application non-interactively. This technique was seen in IceID to uninstall AV products on the compromised host to evade detection. This Hunting query maybe a good indicator that some process tries to uninstall application using wmic which is not a common behavior. This approach may seen in some script or third part appication to uninstall their application but it is a good thing to check what it uninstall and why.
 action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 action.escu.known_false_positives = Third party application may use this approach to uninstall applications.
 action.escu.creation_date = 2022-07-19
@@ -40137,7 +40137,7 @@ action.escu.full_search_name = ESCU - Wmic NonInteractive App Uninstallation - R
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
-action.escu.analytic_story = ["IcedID", "Azorult"]
+action.escu.analytic_story = ["IceID", "Azorult"]
 action.risk = 1
 action.risk.param._risk_message = Wmic $process_name$ with command-line $process$ on $dest$ attempting to uninstall software.
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
@@ -40148,7 +40148,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Wmic NonInteractive App Uninstallation - Rule
-action.correlationsearch.annotations = {"analytic_story": ["IcedID", "Azorult"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}, {"name": "process_name", "role": ["Target"], "type": "Process"}]}
+action.correlationsearch.annotations = {"analytic_story": ["IceID", "Azorult"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}, {"name": "process_name", "role": ["Target"], "type": "Process"}]}
 schedule_window = auto
 alert.digest_mode = 1
 disabled = true
diff --git a/dist/escu/default/transforms.conf b/dist/escu/default/transforms.conf
index 94a7b2c78d..efe440f625 100644
--- a/dist/escu/default/transforms.conf
+++ b/dist/escu/default/transforms.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-09-27T00:24:02 UTC
+# On Date: 2022-09-27T18:03:17 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
diff --git a/dist/escu/default/workflow_actions.conf b/dist/escu/default/workflow_actions.conf
index 5651198f51..3ec21c9353 100644
--- a/dist/escu/default/workflow_actions.conf
+++ b/dist/escu/default/workflow_actions.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-09-27T00:24:02 UTC
+# On Date: 2022-09-27T18:03:17 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml
index 6e7e5a60bd..111da21cfc 100644
--- a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml
+++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml
@@ -67,4 +67,4 @@ test:
     attack_data:
     - file_name: 4688_windows-security.log
       data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/4688_windows-security.log
-      source: XmlWinEventLog
+      source: WinEventLog:Security

From 1d92170216802f8e963f3e16895acea5eb7e57f1 Mon Sep 17 00:00:00 2001
From: research bot <research@splunk.com>
Date: Tue, 27 Sep 2022 18:14:20 +0000
Subject: [PATCH 08/10] updating docs and package bits [ci skip]

---
 dist/escu/app.manifest                   | 2 +-
 dist/escu/default/analyticstories.conf   | 2 +-
 dist/escu/default/app.conf               | 4 ++--
 dist/escu/default/collections.conf       | 2 +-
 dist/escu/default/content-version.conf   | 2 +-
 dist/escu/default/es_investigations.conf | 2 +-
 dist/escu/default/macros.conf            | 2 +-
 dist/escu/default/savedsearches.conf     | 2 +-
 dist/escu/default/transforms.conf        | 2 +-
 dist/escu/default/workflow_actions.conf  | 2 +-
 10 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/dist/escu/app.manifest b/dist/escu/app.manifest
index bb586751ff..8212bdbc8b 100644
--- a/dist/escu/app.manifest
+++ b/dist/escu/app.manifest
@@ -5,7 +5,7 @@
     "id": {
       "group": null, 
       "name": "DA-ESS-ContentUpdate", 
-      "version": "0.0.000001"
+      "version": "0.0.000002"
     }, 
     "author": [
       {
diff --git a/dist/escu/default/analyticstories.conf b/dist/escu/default/analyticstories.conf
index 3c61bf79ab..704755207b 100644
--- a/dist/escu/default/analyticstories.conf
+++ b/dist/escu/default/analyticstories.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-09-27T18:03:17 UTC
+# On Date: 2022-09-27T18:06:28 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
diff --git a/dist/escu/default/app.conf b/dist/escu/default/app.conf
index ba06fcf038..7a25cabde6 100644
--- a/dist/escu/default/app.conf
+++ b/dist/escu/default/app.conf
@@ -4,7 +4,7 @@
 is_configured = false
 state = enabled
 state_change_requires_restart = false
-build = 10120
+build = 10122
 
 [triggers]
 reload.analytic_stories = simple
@@ -20,7 +20,7 @@ reload.es_investigations = simple
 
 [launcher]
 author = Splunk
-version = 0.0.000001
+version = 0.0.000002
 description = Explore the Analytic Stories included with ES Content Updates.
 
 [ui]
diff --git a/dist/escu/default/collections.conf b/dist/escu/default/collections.conf
index 01b1163a2e..a48ec385d8 100644
--- a/dist/escu/default/collections.conf
+++ b/dist/escu/default/collections.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-09-27T18:03:17 UTC
+# On Date: 2022-09-27T18:06:28 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
diff --git a/dist/escu/default/content-version.conf b/dist/escu/default/content-version.conf
index 8159091eff..4afa1348af 100644
--- a/dist/escu/default/content-version.conf
+++ b/dist/escu/default/content-version.conf
@@ -1,2 +1,2 @@
 [content-version]
-version = 0.0.000001
+version = 0.0.000002
diff --git a/dist/escu/default/es_investigations.conf b/dist/escu/default/es_investigations.conf
index 1a4ab96070..c6a352e7bc 100644
--- a/dist/escu/default/es_investigations.conf
+++ b/dist/escu/default/es_investigations.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-09-27T18:03:17 UTC
+# On Date: 2022-09-27T18:06:28 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
diff --git a/dist/escu/default/macros.conf b/dist/escu/default/macros.conf
index 22e9d8f997..68167197ed 100644
--- a/dist/escu/default/macros.conf
+++ b/dist/escu/default/macros.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-09-27T18:03:17 UTC
+# On Date: 2022-09-27T18:06:28 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
diff --git a/dist/escu/default/savedsearches.conf b/dist/escu/default/savedsearches.conf
index b97d5bf64c..ef44508645 100644
--- a/dist/escu/default/savedsearches.conf
+++ b/dist/escu/default/savedsearches.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-09-27T18:03:17 UTC
+# On Date: 2022-09-27T18:06:28 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
diff --git a/dist/escu/default/transforms.conf b/dist/escu/default/transforms.conf
index efe440f625..2a657d6fc5 100644
--- a/dist/escu/default/transforms.conf
+++ b/dist/escu/default/transforms.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-09-27T18:03:17 UTC
+# On Date: 2022-09-27T18:06:28 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
diff --git a/dist/escu/default/workflow_actions.conf b/dist/escu/default/workflow_actions.conf
index 3ec21c9353..ee49b0fb08 100644
--- a/dist/escu/default/workflow_actions.conf
+++ b/dist/escu/default/workflow_actions.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-09-27T18:03:17 UTC
+# On Date: 2022-09-27T18:06:28 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

From d90598abc95b5ae3c0092a32bf138fbf1d784c4f Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Tue, 27 Sep 2022 11:30:19 -0700
Subject: [PATCH 09/10] More updates to workflow

---
 .github/workflows/detection-testing.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/detection-testing.yml b/.github/workflows/detection-testing.yml
index 534c269504..76da04fb1f 100644
--- a/.github/workflows/detection-testing.yml
+++ b/.github/workflows/detection-testing.yml
@@ -41,7 +41,7 @@ jobs:
 
   docker-detection-testing-setup:
     runs-on: ubuntu-latest
-    if: contains('refs/tags/', github.ref) == false #don't run on tags - future steps won't run either since they depend on this job
+    if: "!contains(github.ref, 'refs/tags/')" #don't run on tags - future steps won't run either since they depend on this job
     needs: [validate-tag-if-present, quit-for-dependabot]
     steps:  
         - name: Get branch and PR required for detection testing main.py
@@ -119,7 +119,7 @@ jobs:
 
   docker-detection-testing-execution:
     runs-on: ubuntu-latest
-    if: contains('refs/tags/', github.ref) == false #don't run on tags - future steps won't run either since they depend on this job
+    if: "!contains(github.ref, 'refs/tags/')" #don't run on tags - future steps won't run either since they depend on this job
     needs: [docker-detection-testing-setup]
     strategy:
       matrix:
@@ -191,7 +191,7 @@ jobs:
           
   docker-detection-testing-execution-merge-results:
     runs-on: ubuntu-latest
-    if: contains('refs/tags/', github.ref) == false #don't run on tags - future steps won't run either since they depend on this job
+    if: "!contains(github.ref, 'refs/tags/')" #don't run on tags - future steps won't run either since they depend on this job
     needs: [docker-detection-testing-setup, docker-detection-testing-execution]
  
     steps:  

From 0b01b5fc5a54261859a4400b4e52e8afc3a0c40f Mon Sep 17 00:00:00 2001
From: research bot <research@splunk.com>
Date: Tue, 27 Sep 2022 18:46:05 +0000
Subject: [PATCH 10/10] updating docs and package bits [ci skip]

---
 dist/escu/app.manifest                   | 2 +-
 dist/escu/default/analyticstories.conf   | 2 +-
 dist/escu/default/app.conf               | 4 ++--
 dist/escu/default/collections.conf       | 2 +-
 dist/escu/default/content-version.conf   | 2 +-
 dist/escu/default/es_investigations.conf | 2 +-
 dist/escu/default/macros.conf            | 2 +-
 dist/escu/default/savedsearches.conf     | 2 +-
 dist/escu/default/transforms.conf        | 2 +-
 dist/escu/default/workflow_actions.conf  | 2 +-
 10 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/dist/escu/app.manifest b/dist/escu/app.manifest
index 8212bdbc8b..72139cad90 100644
--- a/dist/escu/app.manifest
+++ b/dist/escu/app.manifest
@@ -5,7 +5,7 @@
     "id": {
       "group": null, 
       "name": "DA-ESS-ContentUpdate", 
-      "version": "0.0.000002"
+      "version": "0.0.000003"
     }, 
     "author": [
       {
diff --git a/dist/escu/default/analyticstories.conf b/dist/escu/default/analyticstories.conf
index 704755207b..4c56ff22df 100644
--- a/dist/escu/default/analyticstories.conf
+++ b/dist/escu/default/analyticstories.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-09-27T18:06:28 UTC
+# On Date: 2022-09-27T18:37:47 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
diff --git a/dist/escu/default/app.conf b/dist/escu/default/app.conf
index 7a25cabde6..f4bdeba677 100644
--- a/dist/escu/default/app.conf
+++ b/dist/escu/default/app.conf
@@ -4,7 +4,7 @@
 is_configured = false
 state = enabled
 state_change_requires_restart = false
-build = 10122
+build = 10124
 
 [triggers]
 reload.analytic_stories = simple
@@ -20,7 +20,7 @@ reload.es_investigations = simple
 
 [launcher]
 author = Splunk
-version = 0.0.000002
+version = 0.0.000003
 description = Explore the Analytic Stories included with ES Content Updates.
 
 [ui]
diff --git a/dist/escu/default/collections.conf b/dist/escu/default/collections.conf
index a48ec385d8..cc9a97e218 100644
--- a/dist/escu/default/collections.conf
+++ b/dist/escu/default/collections.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-09-27T18:06:28 UTC
+# On Date: 2022-09-27T18:37:47 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
diff --git a/dist/escu/default/content-version.conf b/dist/escu/default/content-version.conf
index 4afa1348af..7f68cd1562 100644
--- a/dist/escu/default/content-version.conf
+++ b/dist/escu/default/content-version.conf
@@ -1,2 +1,2 @@
 [content-version]
-version = 0.0.000002
+version = 0.0.000003
diff --git a/dist/escu/default/es_investigations.conf b/dist/escu/default/es_investigations.conf
index c6a352e7bc..0fe78c4c30 100644
--- a/dist/escu/default/es_investigations.conf
+++ b/dist/escu/default/es_investigations.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-09-27T18:06:28 UTC
+# On Date: 2022-09-27T18:37:47 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
diff --git a/dist/escu/default/macros.conf b/dist/escu/default/macros.conf
index 68167197ed..b26874dee6 100644
--- a/dist/escu/default/macros.conf
+++ b/dist/escu/default/macros.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-09-27T18:06:28 UTC
+# On Date: 2022-09-27T18:37:47 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
diff --git a/dist/escu/default/savedsearches.conf b/dist/escu/default/savedsearches.conf
index ef44508645..2239412dbf 100644
--- a/dist/escu/default/savedsearches.conf
+++ b/dist/escu/default/savedsearches.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-09-27T18:06:28 UTC
+# On Date: 2022-09-27T18:37:47 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
diff --git a/dist/escu/default/transforms.conf b/dist/escu/default/transforms.conf
index 2a657d6fc5..6bf44b2b2e 100644
--- a/dist/escu/default/transforms.conf
+++ b/dist/escu/default/transforms.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-09-27T18:06:28 UTC
+# On Date: 2022-09-27T18:37:47 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
diff --git a/dist/escu/default/workflow_actions.conf b/dist/escu/default/workflow_actions.conf
index ee49b0fb08..d9a88b6201 100644
--- a/dist/escu/default/workflow_actions.conf
+++ b/dist/escu/default/workflow_actions.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-09-27T18:06:28 UTC
+# On Date: 2022-09-27T18:37:47 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############