From 90ca4186ed108aee249323de6cf9a34b7b352df1 Mon Sep 17 00:00:00 2001
From: d1vious <josehelps@gmail.com>
Date: Tue, 12 Apr 2022 17:12:25 -0400
Subject: [PATCH] fixing minor linking bug

---
 .../adapter/templates/doc_detections.j2       |   2 +-
 docs/_pages/detections.md                     |   1 +
 docs/_pages/stories.md                        |   2 +-
 .../2017-09-23-monitor_dns_for_brand_abuse.md |   2 +-
 ...0-13-unusually_long_content-type_length.md |   2 +-
 ...nce_started_in_previously_unseen_region.md |   2 +-
 ...ance_started_with_previously_unseen_ami.md |   2 +-
 ...16-detect_new_api_calls_from_user_roles.md |   2 +-
 ...detect_spike_in_security_group_activity.md |   2 +-
 ...ect_api_activity_from_users_without_mfa.md |   2 +-
 ...21-detect_spike_in_network_acl_activity.md |   2 +-
 ...18-06-28-detect_s3_access_from_a_new_ip.md |   2 +-
 ...18-10-08-web_fraud_-_account_harvesting.md |   2 +-
 ...8-web_fraud_-_anomalous_user_clickspeed.md |   2 +-
 ...raud_-_password_sharing_across_accounts.md |   2 +-
 ...-10-23-wmi_permanent_event_subscription.md |   2 +-
 ...-10-23-wmi_temporary_event_subscription.md |   2 +-
 .../2018-12-06-suspicious_java_classes.md     |   2 +-
 ...01-29-osquery_pack_-_coldroot_detection.md |   2 +-
 .../2019-04-25-suspicious_file_write.md       |   2 +-
 ...5-08-unusually_long_command_line_-_mltk.md |   2 +-
 ...9-10-11-prohibited_software_on_endpoint.md |   2 +-
 ...credential_dumping_through_lsass_access.md |   2 +-
 ...-03-detect_mimikatz_using_loaded_images.md |   2 +-
 ...6-access_lsass_memory_for_dump_creation.md |   2 +-
 ...9-12-06-create_remote_thread_into_lsass.md |   2 +-
 ...19-12-06-unsigned_image_loaded_by_lsass.md |   2 +-
 ...-01-22-dns_query_length_outliers_-_mltk.md |   2 +-
 ...-03-creation_of_lsass_dump_with_taskmgr.md |   2 +-
 ...ed_with_previously_unseen_instance_type.md |   2 +-
 ...20-02-07-macos_-_re-opened_applications.md |   2 +-
 .../2020-02-21-dump_lsass_via_comsvcs_dll.md  |   2 +-
 .../2020-03-16-detect_rare_executables.md     |   2 +-
 ...5-gcp_kubernetes_cluster_scan_detection.md |   2 +-
 ...0-first_time_seen_child_process_of_zoom.md |   2 +-
 .../2020-07-06-windows_event_log_cleared.md   |   2 +-
 ...h_aws_instances_launched_by_user_-_mltk.md |   2 +-
 ...aws_instances_terminated_by_user_-_mltk.md |   2 +-
 ...api_activities_from_unapproved_accounts.md |   2 +-
 ..._to_phishing_sites_leveraging_evilginx2.md |   8 +-
 ...07-21-detect_new_user_aws_console_login.md |   2 +-
 ...web_traffic_to_dynamic_domain_providers.md |   2 +-
 ...ce_modified_with_previously_unseen_user.md |   2 +-
 ...nce_started_with_previously_unseen_user.md |   2 +-
 ...shell_process_-_execution_policy_bypass.md |   4 +-
 ...th_invalid_credentials_from_the_same_ip.md |   2 +-
 .../2020-07-21-okta_failed_sso_attempts.md    |   2 +-
 ...1-okta_user_logins_from_multiple_cities.md |   2 +-
 .../2020-07-22-smb_traffic_spike_-_mltk.md    |   2 +-
 ...20-07-22-suspicious_email_-_uba_anomaly.md |   2 +-
 ...-suspicious_email_attachment_extensions.md |   2 +-
 ...ous_writes_to_system_volume_information.md |   2 +-
 ...20-07-22-uncommon_processes_on_endpoint.md |   2 +-
 ...-08-02-detect_f5_tmui_rce_cve-2020-5902.md |   2 +-
 .../_posts/2020-08-11-detect_arp_poisoning.md |   2 +-
 .../2020-08-11-detect_rogue_dhcp_server.md    |   2 +-
 ...oud_network_access_control_list_deleted.md |   2 +-
 ...ect_ipv6_network_infrastructure_threats.md |   2 +-
 ...20-10-28-detect_port_security_violation.md |   2 +-
 .../2020-10-28-detect_traffic_mirroring.md    |   2 +-
 ...2020-11-09-common_ransomware_extensions.md |   2 +-
 .../2020-11-09-common_ransomware_notes.md     |   2 +-
 ..._system_network_configuration_discovery.md |   2 +-
 ...rohibited_applications_spawning_cmd_exe.md |   4 +-
 ...processes_run_from_unexpected_locations.md |   2 +-
 ...i_permanent_event_subscription_-_sysmon.md |   2 +-
 ...burst_correlation_dll_and_network_event.md |   2 +-
 ...ng_keys_with_encrypt_policy_without_mfa.md |   2 +-
 ..._with_kms_keys_performing_encryption_s3.md |   2 +-
 ...ontrol_list_created_with_all_open_ports.md |   2 +-
 ...aws_network_access_control_list_deleted.md |   2 +-
 ...ell_process_with_obfuscation_techniques.md |   2 +-
 ...cious_powershell_command-line_arguments.md |   2 +-
 ...20-detect_rundll32_inline_hta_execution.md |   2 +-
 ...l_access_by_provider_user_and_principal.md |   2 +-
 ...01-26-aws_saml_update_identity_provider.md |   2 +-
 ...1-27-detect_baron_samedit_cve-2021-3156.md |   2 +-
 ...baron_samedit_cve-2021-3156_via_osquery.md |   2 +-
 ...ect_regsvr32_application_control_bypass.md |   2 +-
 ...cious_regsvr32_register_suspicious_path.md |   2 +-
 ...ct_baron_samedit_cve-2021-3156_segfault.md |   2 +-
 ...21-02-01-dump_lsass_via_procdump_rename.md |   2 +-
 ...32_application_control_bypass_-_advpack.md |   4 +-
 ...2_application_control_bypass_-_setupapi.md |   4 +-
 ...2_application_control_bypass_-_syssetup.md |   4 +-
 .../2021-02-04-suspicious_rundll32_startw.md  |   2 +-
 ...9-suspicious_rundll32_dllregisterserver.md |   2 +-
 ...e_policy_version_to_allow_all_resources.md |   2 +-
 .../2021-02-22-cobalt_strike_named_pipes.md   |   2 +-
 .../2021-03-01-any_powershell_downloadfile.md |   2 +-
 ...021-03-01-any_powershell_downloadstring.md |   2 +-
 .../2021-03-02-aws_setdefaultpolicyversion.md |   2 +-
 ...2021-03-03-nishang_powershelltcponeline.md |   2 +-
 docs/_posts/2021-03-03-w3wp_spawning_shell.md |   4 +-
 ...21-03-12-ransomware_notes_bulk_creation.md |   2 +-
 ...3-16-high_process_termination_frequency.md |   2 +-
 ...16-windows_high_file_deletion_frequency.md |   2 +-
 ...3-17-clop_ransomware_known_service_name.md |   2 +-
 ...021-03-23-certutil_with_decode_argument.md |   2 +-
 ...021-03-29-powershell_start-bitstransfer.md |   4 +-
 ...03-31-aws_iam_successful_group_deletion.md |   2 +-
 ...021-03-31-disabling_firewall_with_netsh.md |   2 +-
 ...-aws_iam_assume_role_policy_brute_force.md |   2 +-
 .../2021-04-01-aws_iam_delete_policy.md       |   2 +-
 ...21-04-01-aws_iam_failure_group_deletion.md |   2 +-
 ...icious_powershell_executed_as_a_service.md |   2 +-
 .../2021-04-12-excel_spawning_powershell.md   |   2 +-
 .../2021-04-12-winword_spawning_powershell.md |   2 +-
 ...1-04-13-aws_excessive_security_scanning.md |   2 +-
 ...fice_application_spawn_rundll32_process.md |   2 +-
 ...-office_document_creating_schedule_task.md |   2 +-
 ...14-office_document_executing_macro_code.md |   2 +-
 ..._remote_thread_to_known_windows_process.md |   2 +-
 ...ess_connecting_to_ip_check_web_services.md |   2 +-
 ...9-wermgr_process_create_executable_file.md |   2 +-
 ...ocess_spawned_cmd_or_powershell_process.md |   4 +-
 ...1-04-21-excessive_usage_of_nslookup_app.md |   2 +-
 ...ultiple_archive_files_http_post_traffic.md |   2 +-
 ...e_product_spawning_rundll32_with_no_dll.md |   2 +-
 ...-04-22-plain_http_post_exfiltrated_data.md |   2 +-
 .../_posts/2021-04-22-winword_spawning_cmd.md |   2 +-
 ...04-26-office_product_spawning_bitsadmin.md |   2 +-
 ...-04-26-office_product_spawning_certutil.md |   2 +-
 docs/_posts/2021-04-26-trickbot_named_pipe.md |   2 +-
 ...021-04-29-suspicious_driver_loaded_path.md |   2 +-
 docs/_posts/2021-04-29-xmrig_driver_loaded.md |   2 +-
 ...021-05-06-download_files_using_telegram.md |   2 +-
 ...2021-05-13-cmlua_or_cmstplua_uac_bypass.md |   2 +-
 .../2021-05-20-cmd_echo_pipe_-_escalation.md  |   4 +-
 ...etect_azurehound_command-line_arguments.md |   2 +-
 ...etect_sharphound_command-line_arguments.md |   2 +-
 .../2021-06-02-modification_of_wallpaper.md   |   2 +-
 ...021-06-02-wbemprox_com_object_execution.md |   2 +-
 ...-04-known_services_killed_by_ransomware.md |   2 +-
 ...tect_wmi_event_subscription_persistence.md |   2 +-
 ...ursive_delete_of_directory_in_batch_cmd.md |   2 +-
 ...w_file_and_printing_sharing_in_firewall.md |   2 +-
 ...-23-allow_network_discovery_in_firewall.md |   2 +-
 ...4-excessive_usage_of_sc_service_utility.md |   2 +-
 ...1-print_spooler_adding_a_printer_driver.md |   2 +-
 ...-print_spooler_failed_to_load_a_plug-in.md |   4 +-
 .../2021-07-01-spoolsv_spawning_rundll32.md   |   2 +-
 ...07-01-spoolsv_suspicious_loaded_modules.md |   2 +-
 ...07-01-spoolsv_suspicious_process_access.md |   2 +-
 ...21-07-01-spoolsv_writing_a_dll_-_sysmon.md |   4 +-
 ...-powershell_disable_security_monitoring.md |   2 +-
 ...-07-12-uac_bypass_mmc_load_unsigned_dll.md |   2 +-
 .../2021-07-19-aws_createloginprofile.md      |   2 +-
 .../2021-07-19-detect_new_open_s3_buckets.md  |   2 +-
 ...detect_new_open_s3_buckets_over_aws_cli.md |   2 +-
 ...a_spawning_rundll32_or_regsvr32_process.md |   4 +-
 ...-07-19-office_product_spawn_cmd_process.md |   2 +-
 ...-rundll32_createremotethread_in_browser.md |   2 +-
 ...rundll32_process_creating_exe_dll_files.md |   2 +-
 ...7-26-suspicious_icedid_rundll32_cmdline.md |   2 +-
 ...21-07-26-suspicious_rundll32_plugininit.md |   2 +-
 ...gsvr32_with_known_silent_switch_cmdline.md |   2 +-
 ...dll32_create_remote_thread_to_a_process.md |   2 +-
 .../2021-07-30-drop_icedid_license_dat.md     |   2 +-
 ...edid_exfiltrated_archived_file_creation.md |   2 +-
 ...fice_application_spawn_regsvr32_process.md |   2 +-
 ...2021-08-03-sqlite_module_in_temp_folder.md |   2 +-
 ...eate_remote_thread_in_shell_application.md |   2 +-
 ...8-13-uac_bypass_with_colorui_com_object.md |   2 +-
 ...16-gsuite_drive_share_in_external_email.md |   2 +-
 ...ws_ecr_container_scanning_findings_high.md |   2 +-
 ...ning_findings_low_informational_unknown.md |   2 +-
 ..._ecr_container_scanning_findings_medium.md |   2 +-
 ...container_upload_outside_business_hours.md |   2 +-
 ...9-aws_ecr_container_upload_unknown_user.md |   2 +-
 ...1-08-20-github_commit_changes_in_master.md |   8 +-
 ...8-23-gsuite_suspicious_shared_file_name.md |   2 +-
 ...1-08-24-get-domaintrust_with_powershell.md |   2 +-
 ...omaintrust_with_powershell_script_block.md |   2 +-
 ...-08-24-kubernetes_scanner_image_pulling.md |   2 +-
 ...8-27-exchange_powershell_abuse_via_ssrf.md |   2 +-
 .../2021-09-01-github_commit_in_develop.md    |   2 +-
 .../2021-09-01-github_dependabot_alert.md     |   2 +-
 ...1-github_pull_request_from_unknown_user.md |   4 +-
 ...1-09-02-get-foresttrust_with_powershell.md |   2 +-
 ...oresttrust_with_powershell_script_block.md |   2 +-
 ...e_by_app_connect_and_create_adsi_object.md |   2 +-
 ...2021-09-08-rundll32_control_rundll_hunt.md |   2 +-
 ...control_rundll_world_writable_directory.md |   2 +-
 ...2021-09-09-extraction_of_registry_hives.md |   2 +-
 ...09-mshtml_module_load_in_office_product.md |   2 +-
 ...s_scripting_process_loading_ldap_module.md |   2 +-
 ...ms_scripting_process_loading_wmi_module.md |   2 +-
 ...t_to_add_certificate_to_untrusted_store.md |   2 +-
 ...edential_dump_from_registry_via_reg_exe.md |   2 +-
 .../_posts/2021-09-16-bits_job_persistence.md |   2 +-
 .../2021-09-16-bitsadmin_download_file.md     |   2 +-
 ...of_shadow_copy_with_wmic_and_powershell.md |   4 +-
 ...mping_via_copy_command_from_shadow_copy.md |   2 +-
 ...tial_dumping_via_symlink_to_shadow_copy.md |   2 +-
 ...9-16-detect_psexec_with_accepteula_flag.md |   2 +-
 .../_posts/2021-09-16-detect_renamed_7-zip.md |   2 +-
 .../2021-09-16-detect_renamed_psexec.md       |   2 +-
 .../2021-09-16-dump_lsass_via_procdump.md     |   2 +-
 .../2021-09-16-processes_launching_netsh.md   |   2 +-
 .../2021-09-29-verclsid_clsid_execution.md    |   2 +-
 ...32_silent_and_install_param_dll_loading.md |   2 +-
 .../2021-10-05-rundll32_shimcache_flush.md    |   2 +-
 ...2-aws_iam_accessdenied_discovery_events.md |   2 +-
 ...21-11-12-csc_net_on_the_fly_compilation.md |   2 +-
 ...twork_discovery_using_route_windows_app.md |   2 +-
 ...21-11-12-runas_execution_in_commandline.md |   2 +-
 ...12-windows_installutil_credential_theft.md |   2 +-
 ...12-windows_installutil_uninstall_option.md |   2 +-
 ...windows_installutil_url_in_command_line.md |   2 +-
 ...s_instantiation_via_dcom_and_powershell.md |   2 +-
 ...ss_instantiation_via_wmi_and_powershell.md |   2 +-
 ..._instantiation_via_winrm_and_powershell.md |   2 +-
 .../2021-11-18-loading_of_dynwrapx_module.md  |   2 +-
 ...ce_created_with_suspicious_service_path.md |   2 +-
 ...dows_service_created_within_public_path.md |   2 +-
 ...-11-29-detect_rclone_command-line_usage.md |   4 +-
 ...-msi_module_loaded_by_non-system_binary.md |   4 +-
 .../2021-12-13-linux_java_spawning_shell.md   |   2 +-
 ..._connect_to_internet_with_hidden_window.md |   4 +-
 ..._hunting_system_account_targeting_lsass.md |   2 +-
 ...dows_non-system_account_targeting_lsass.md |   4 +-
 ...tentially_malicious_code_on_commandline.md |   2 +-
 ...-cmd_carry_out_string_command_parameter.md |   2 +-
 ...us_powershell_process_-_encoded_command.md |   4 +-
 ...cess_dns_query_known_abuse_web_services.md |   2 +-
 ...spicious_process_with_discord_dns_query.md |   2 +-
 ...dows_dotnet_binary_in_non_standard_path.md |   2 +-
 ...indows_installutil_in_non_standard_path.md |   2 +-
 ...ive_file_deletion_in_windefender_folder.md |   2 +-
 .../2022-01-20-ping_sleep_batch_command.md    |   2 +-
 .../2022-01-24-windows_nirsoft_utilities.md   |   2 +-
 ...6-log4shell_cve-2021-44228_exploitation.md |   2 +-
 ...-27-windows_possible_credential_dumping.md |   2 +-
 ...8-hide_user_account_from_sign-in_screen.md |   2 +-
 .../2022-02-01-suspicious_rundll32_rename.md  |   2 +-
 ...nload_with_urlcache_and_split_arguments.md |   2 +-
 ...load_with_verifyctl_and_split_arguments.md |   2 +-
 ..._ticket_exports_through_winlogon_access.md |   2 +-
 ...7-windows_schtasks_create_run_as_system.md |   2 +-
 ...022-02-08-rundll_loading_dll_by_ordinal.md |   2 +-
 ...2-15-windows_diskshadow_proxy_execution.md |   2 +-
 ..._raw_access_to_master_boot_record_drive.md |   2 +-
 ...8-detect_regasm_with_network_connection.md |   2 +-
 ...-detect_regsvcs_with_network_connection.md |   2 +-
 ...authentication_discovery_with_powerview.md |   2 +-
 ...-process_deleting_its_process_file_path.md |   2 +-
 docs/_posts/2022-02-18-rundll32_dnsquery.md   |   2 +-
 ...uthentication_discovery_with_get-aduser.md |   2 +-
 ...ion_flag_disabled_in_useraccountcontrol.md |   2 +-
 ...ntication_flag_disabled_with_powershell.md |   2 +-
 ...ndows_excessive_disabled_services_event.md |   2 +-
 ...ows_raw_access_to_disk_volume_partition.md |   2 +-
 docs/_posts/2022-03-03-aws_createaccesskey.md |   2 +-
 .../2022-03-03-aws_updateloginprofile.md      |   2 +-
 ..._regsvcs_with_no_command_line_arguments.md |   2 +-
 ..._no_command_line_arguments_with_network.md |   2 +-
 ...cious_dllhost_no_command_line_arguments.md |   2 +-
 ...ious_gpupdate_no_command_line_arguments.md |   2 +-
 ...ious_rundll32_no_command_line_arguments.md |   2 +-
 ...s_installutil_remote_network_connection.md |   2 +-
 ...stallutil_uninstall_option_with_network.md |   2 +-
 ...24-splunk_dos_via_malformed_s2s_request.md |   2 +-
 ...03-28-windows_terminating_lsass_process.md |   2 +-
 ...ithub_actions_disable_security_workflow.md | 170 ++++++++++++++++++
 ...4-04-windows_event_for_service_disabled.md | 163 +++++++++++++++++
 docs/_stories/dev_sec_ops.md                  |   1 +
 267 files changed, 622 insertions(+), 289 deletions(-)
 create mode 100644 docs/_posts/2022-04-04-github_actions_disable_security_workflow.md
 create mode 100644 docs/_posts/2022-04-04-windows_event_for_service_disabled.md

diff --git a/bin/contentctl_project/contentctl_infrastructure/adapter/templates/doc_detections.j2 b/bin/contentctl_project/contentctl_infrastructure/adapter/templates/doc_detections.j2
index a762d8aab4..15184cd52c 100644
--- a/bin/contentctl_project/contentctl_infrastructure/adapter/templates/doc_detections.j2
+++ b/bin/contentctl_project/contentctl_infrastructure/adapter/templates/doc_detections.j2
@@ -203,4 +203,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 {% endfor %}
 {% endif %}
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/{% if object.experimental is sameas true -%}experimental/{%- endif -%}{{object.source}}/{{ object.name | lower | replace (" ", "_") }}.yml) \| *version*: **{{object.version}}**
\ No newline at end of file
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/{% if object.experimental is sameas true -%}experimental/{%- endif -%}{{object.source}}/{{ object.name | lower | replace (" ", "_") | replace("-", "_") }}.yml) \| *version*: **{{object.version}}**
diff --git a/docs/_pages/detections.md b/docs/_pages/detections.md
index 40bede90ab..b846ccd7e7 100644
--- a/docs/_pages/detections.md
+++ b/docs/_pages/detections.md
@@ -368,6 +368,7 @@ sidebar:
 | [GetWmiObject Ds Group with PowerShell Script Block](/endpoint/getwmiobject_ds_group_with_powershell_script_block/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Domain Groups](/tags/#domain-groups) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [GetWmiObject User Account with PowerShell](/endpoint/getwmiobject_user_account_with_powershell/) | [Account Discovery](/tags/#account-discovery), [Local Account](/tags/#local-account) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [GetWmiObject User Account with PowerShell Script Block](/endpoint/getwmiobject_user_account_with_powershell_script_block/) | [Account Discovery](/tags/#account-discovery), [Local Account](/tags/#local-account) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [GitHub Actions Disable Security Workflow](/cloud/github_actions_disable_security_workflow/) | [Compromise Software Supply Chain](/tags/#compromise-software-supply-chain), [Supply Chain Compromise](/tags/#supply-chain-compromise) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [GitHub Dependabot Alert](/cloud/github_dependabot_alert/) | [Compromise Software Dependencies and Development Tools](/tags/#compromise-software-dependencies-and-development-tools), [Supply Chain Compromise](/tags/#supply-chain-compromise) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [GitHub Pull Request from Unknown User](/cloud/github_pull_request_from_unknown_user/) | [Compromise Software Dependencies and Development Tools](/tags/#compromise-software-dependencies-and-development-tools), [Supply Chain Compromise](/tags/#supply-chain-compromise) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Github Commit Changes In Master](/cloud/github_commit_changes_in_master/) | [Trusted Relationship](/tags/#trusted-relationship) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
diff --git a/docs/_pages/stories.md b/docs/_pages/stories.md
index 449a45eb17..2a06a4b485 100644
--- a/docs/_pages/stories.md
+++ b/docs/_pages/stories.md
@@ -47,7 +47,7 @@ sidebar:
 | [Data Protection](data_protection) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Drive-by Compromise](/tags/#drive-by-compromise) | [Exfiltration](/tags/#exfiltration), [Initial Access](/tags/#initial-access) |
 | [Deobfuscate-Decode Files or Information](deobfuscate-decode_files_or_information) | [Deobfuscate/Decode Files or Information](/tags/#deobfuscate/decode-files-or-information) | [Defense Evasion](/tags/#defense-evasion) |
 | [Detect Zerologon Attack](detect_zerologon_attack) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping), [Exploitation of Remote Services](/tags/#exploitation-of-remote-services), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Credential Access](/tags/#credential-access), [Initial Access](/tags/#initial-access), [Lateral Movement](/tags/#lateral-movement) |
-| [Dev Sec Ops](dev_sec_ops) | [Malicious Image](/tags/#malicious-image), [User Execution](/tags/#user-execution), [Compromise Client Software Binary](/tags/#compromise-client-software-binary), [Trusted Relationship](/tags/#trusted-relationship), [Compromise Software Dependencies and Development Tools](/tags/#compromise-software-dependencies-and-development-tools), [Supply Chain Compromise](/tags/#supply-chain-compromise), [Exfiltration to Cloud Storage](/tags/#exfiltration-to-cloud-storage), [Exfiltration Over Web Service](/tags/#exfiltration-over-web-service), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Phishing](/tags/#phishing), [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [Exploitation for Credential Access](/tags/#exploitation-for-credential-access), [Cloud Service Discovery](/tags/#cloud-service-discovery) | [Credential Access](/tags/#credential-access), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Exfiltration](/tags/#exfiltration), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence) |
+| [Dev Sec Ops](dev_sec_ops) | [Malicious Image](/tags/#malicious-image), [User Execution](/tags/#user-execution), [Compromise Client Software Binary](/tags/#compromise-client-software-binary), [Compromise Software Supply Chain](/tags/#compromise-software-supply-chain), [Supply Chain Compromise](/tags/#supply-chain-compromise), [Trusted Relationship](/tags/#trusted-relationship), [Compromise Software Dependencies and Development Tools](/tags/#compromise-software-dependencies-and-development-tools), [Exfiltration to Cloud Storage](/tags/#exfiltration-to-cloud-storage), [Exfiltration Over Web Service](/tags/#exfiltration-over-web-service), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Phishing](/tags/#phishing), [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [Exploitation for Credential Access](/tags/#exploitation-for-credential-access), [Cloud Service Discovery](/tags/#cloud-service-discovery) | [Credential Access](/tags/#credential-access), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Exfiltration](/tags/#exfiltration), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence) |
 | [Disabling Security Tools](disabling_security_tools) | [Install Root Certificate](/tags/#install-root-certificate), [Subvert Trust Controls](/tags/#subvert-trust-controls), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Modify Registry](/tags/#modify-registry) | [Defense Evasion](/tags/#defense-evasion), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
 | [Domain Trust Discovery](domain_trust_discovery) | [Domain Trust Discovery](/tags/#domain-trust-discovery), [Remote System Discovery](/tags/#remote-system-discovery) | [Discovery](/tags/#discovery) |
 | [Double Zero Destructor](double_zero_destructor) | [Masquerading](/tags/#masquerading), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Modify Registry](/tags/#modify-registry), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | [Defense Evasion](/tags/#defense-evasion), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
diff --git a/docs/_posts/2017-09-23-monitor_dns_for_brand_abuse.md b/docs/_posts/2017-09-23-monitor_dns_for_brand_abuse.md
index e10022ff57..6aff52ae89 100644
--- a/docs/_posts/2017-09-23-monitor_dns_for_brand_abuse.md
+++ b/docs/_posts/2017-09-23-monitor_dns_for_brand_abuse.md
@@ -96,8 +96,8 @@ This search looks for DNS requests for faux domains similar to the domains that
 #### Macros
 The SPL above uses the following Macros:
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [brand_abuse_dns](https://github.com/splunk/security_content/blob/develop/macros/brand_abuse_dns.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **monitor_dns_for_brand_abuse_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2017-10-13-unusually_long_content-type_length.md b/docs/_posts/2017-10-13-unusually_long_content-type_length.md
index a13423589a..c08dc1b515 100644
--- a/docs/_posts/2017-10-13-unusually_long_content-type_length.md
+++ b/docs/_posts/2017-10-13-unusually_long_content-type_length.md
@@ -148,4 +148,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/experimental/network/unusually_long_content-type_length.yml) \| *version*: **1**
\ No newline at end of file
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/experimental/network/unusually_long_content_type_length.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2018-02-23-ec2_instance_started_in_previously_unseen_region.md b/docs/_posts/2018-02-23-ec2_instance_started_in_previously_unseen_region.md
index 9ab3027499..e6310902ca 100644
--- a/docs/_posts/2018-02-23-ec2_instance_started_in_previously_unseen_region.md
+++ b/docs/_posts/2018-02-23-ec2_instance_started_in_previously_unseen_region.md
@@ -110,8 +110,8 @@ This search looks for AWS CloudTrail events where an instance is started in a pa
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that **ec2_instance_started_in_previously_unseen_region_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2018-03-12-ec2_instance_started_with_previously_unseen_ami.md b/docs/_posts/2018-03-12-ec2_instance_started_with_previously_unseen_ami.md
index f94d3d2d96..9739a63334 100644
--- a/docs/_posts/2018-03-12-ec2_instance_started_with_previously_unseen_ami.md
+++ b/docs/_posts/2018-03-12-ec2_instance_started_with_previously_unseen_ami.md
@@ -106,8 +106,8 @@ This search looks for EC2 instances being created with previously unseen AMIs.
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that **ec2_instance_started_with_previously_unseen_ami_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2018-04-16-detect_new_api_calls_from_user_roles.md b/docs/_posts/2018-04-16-detect_new_api_calls_from_user_roles.md
index f1af016a55..316f2aeec1 100644
--- a/docs/_posts/2018-04-16-detect_new_api_calls_from_user_roles.md
+++ b/docs/_posts/2018-04-16-detect_new_api_calls_from_user_roles.md
@@ -117,8 +117,8 @@ This search detects new API calls that have either never been seen before or tha
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that **detect_new_api_calls_from_user_roles_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2018-04-18-detect_spike_in_security_group_activity.md b/docs/_posts/2018-04-18-detect_spike_in_security_group_activity.md
index d095fbfb1e..9615d0a10f 100644
--- a/docs/_posts/2018-04-18-detect_spike_in_security_group_activity.md
+++ b/docs/_posts/2018-04-18-detect_spike_in_security_group_activity.md
@@ -124,8 +124,8 @@ This search will detect users creating spikes in API activity related to securit
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_group_api_calls](https://github.com/splunk/security_content/blob/develop/macros/security_group_api_calls.yml)
 * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_group_api_calls](https://github.com/splunk/security_content/blob/develop/macros/security_group_api_calls.yml)
 
 Note that **detect_spike_in_security_group_activity_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2018-05-17-detect_api_activity_from_users_without_mfa.md b/docs/_posts/2018-05-17-detect_api_activity_from_users_without_mfa.md
index a0c5914d7d..545f923c77 100644
--- a/docs/_posts/2018-05-17-detect_api_activity_from_users_without_mfa.md
+++ b/docs/_posts/2018-05-17-detect_api_activity_from_users_without_mfa.md
@@ -101,8 +101,8 @@ This search looks for AWS CloudTrail events where a user logged into the AWS acc
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that **detect_api_activity_from_users_without_mfa_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2018-05-21-detect_spike_in_network_acl_activity.md b/docs/_posts/2018-05-21-detect_spike_in_network_acl_activity.md
index 1fc97ee6db..b21dabfa94 100644
--- a/docs/_posts/2018-05-21-detect_spike_in_network_acl_activity.md
+++ b/docs/_posts/2018-05-21-detect_spike_in_network_acl_activity.md
@@ -122,8 +122,8 @@ This search will detect users creating spikes in API activity related to network
 
 #### Macros
 The SPL above uses the following Macros:
-* [network_acl_events](https://github.com/splunk/security_content/blob/develop/macros/network_acl_events.yml)
 * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [network_acl_events](https://github.com/splunk/security_content/blob/develop/macros/network_acl_events.yml)
 
 Note that **detect_spike_in_network_acl_activity_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md b/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md
index 1a6cd28465..7d801f8b3a 100644
--- a/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md
+++ b/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md
@@ -118,8 +118,8 @@ This search looks at S3 bucket-access logs and detects new or previously unseen
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [aws_s3_accesslogs](https://github.com/splunk/security_content/blob/develop/macros/aws_s3_accesslogs.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that **detect_s3_access_from_a_new_ip_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2018-10-08-web_fraud_-_account_harvesting.md b/docs/_posts/2018-10-08-web_fraud_-_account_harvesting.md
index b389b435ad..bf988f4c65 100644
--- a/docs/_posts/2018-10-08-web_fraud_-_account_harvesting.md
+++ b/docs/_posts/2018-10-08-web_fraud_-_account_harvesting.md
@@ -152,4 +152,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/deprecated/web_fraud_-_account_harvesting.yml) \| *version*: **1**
\ No newline at end of file
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/deprecated/web_fraud___account_harvesting.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2018-10-08-web_fraud_-_anomalous_user_clickspeed.md b/docs/_posts/2018-10-08-web_fraud_-_anomalous_user_clickspeed.md
index 2f2bca0560..dfcd3ec940 100644
--- a/docs/_posts/2018-10-08-web_fraud_-_anomalous_user_clickspeed.md
+++ b/docs/_posts/2018-10-08-web_fraud_-_anomalous_user_clickspeed.md
@@ -154,4 +154,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/deprecated/web_fraud_-_anomalous_user_clickspeed.yml) \| *version*: **1**
\ No newline at end of file
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2018-10-08-web_fraud_-_password_sharing_across_accounts.md b/docs/_posts/2018-10-08-web_fraud_-_password_sharing_across_accounts.md
index 796dc22bfa..271f9f3ede 100644
--- a/docs/_posts/2018-10-08-web_fraud_-_password_sharing_across_accounts.md
+++ b/docs/_posts/2018-10-08-web_fraud_-_password_sharing_across_accounts.md
@@ -143,4 +143,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/deprecated/web_fraud_-_password_sharing_across_accounts.yml) \| *version*: **1**
\ No newline at end of file
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/deprecated/web_fraud___password_sharing_across_accounts.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md b/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md
index 36a268849e..fb2f3b310d 100644
--- a/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md
+++ b/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md
@@ -114,8 +114,8 @@ This search looks for the creation of WMI permanent event subscriptions.
 
 #### Macros
 The SPL above uses the following Macros:
-* [wmi](https://github.com/splunk/security_content/blob/develop/macros/wmi.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [wmi](https://github.com/splunk/security_content/blob/develop/macros/wmi.yml)
 
 Note that **wmi_permanent_event_subscription_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md b/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md
index 403fb22f13..f7858e136a 100644
--- a/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md
+++ b/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md
@@ -113,8 +113,8 @@ This search looks for the creation of WMI temporary event subscriptions.
 
 #### Macros
 The SPL above uses the following Macros:
-* [wmi](https://github.com/splunk/security_content/blob/develop/macros/wmi.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [wmi](https://github.com/splunk/security_content/blob/develop/macros/wmi.yml)
 
 Note that **wmi_temporary_event_subscription_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2018-12-06-suspicious_java_classes.md b/docs/_posts/2018-12-06-suspicious_java_classes.md
index 2d8d893263..d60dff7d38 100644
--- a/docs/_posts/2018-12-06-suspicious_java_classes.md
+++ b/docs/_posts/2018-12-06-suspicious_java_classes.md
@@ -102,8 +102,8 @@ This search looks for suspicious Java classes that are often used to exploit rem
 
 #### Macros
 The SPL above uses the following Macros:
-* [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml)
 
 Note that **suspicious_java_classes_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2019-01-29-osquery_pack_-_coldroot_detection.md b/docs/_posts/2019-01-29-osquery_pack_-_coldroot_detection.md
index 4ffdd99b1a..7209452618 100644
--- a/docs/_posts/2019-01-29-osquery_pack_-_coldroot_detection.md
+++ b/docs/_posts/2019-01-29-osquery_pack_-_coldroot_detection.md
@@ -137,4 +137,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/deprecated/osquery_pack_-_coldroot_detection.yml) \| *version*: **1**
\ No newline at end of file
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/deprecated/osquery_pack___coldroot_detection.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2019-04-25-suspicious_file_write.md b/docs/_posts/2019-04-25-suspicious_file_write.md
index 3b65e97b8b..abb49fa3d2 100644
--- a/docs/_posts/2019-04-25-suspicious_file_write.md
+++ b/docs/_posts/2019-04-25-suspicious_file_write.md
@@ -99,9 +99,9 @@ The search looks for files created with names that have been linked to malicious
 
 #### Macros
 The SPL above uses the following Macros:
+* [suspicious_writes](https://github.com/splunk/security_content/blob/develop/macros/suspicious_writes.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [suspicious_writes](https://github.com/splunk/security_content/blob/develop/macros/suspicious_writes.yml)
 
 Note that **suspicious_file_write_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md b/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md
index 0c6d185bed..1127b2ef17 100644
--- a/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md
+++ b/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md
@@ -150,4 +150,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/experimental/endpoint/unusually_long_command_line_-_mltk.yml) \| *version*: **1**
\ No newline at end of file
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/experimental/endpoint/unusually_long_command_line___mltk.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2019-10-11-prohibited_software_on_endpoint.md b/docs/_posts/2019-10-11-prohibited_software_on_endpoint.md
index 1b2a78d77c..797a7a44ad 100644
--- a/docs/_posts/2019-10-11-prohibited_software_on_endpoint.md
+++ b/docs/_posts/2019-10-11-prohibited_software_on_endpoint.md
@@ -102,8 +102,8 @@ This search looks for applications on the endpoint that you have marked as prohi
 
 #### Macros
 The SPL above uses the following Macros:
-* [prohibited_softwares](https://github.com/splunk/security_content/blob/develop/macros/prohibited_softwares.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [prohibited_softwares](https://github.com/splunk/security_content/blob/develop/macros/prohibited_softwares.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **prohibited_software_on_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md b/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md
index c54433e48d..2ddfc74d8d 100644
--- a/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md
+++ b/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md
@@ -114,8 +114,8 @@ This search looks for reading lsass memory consistent with credential dumping.
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 Note that **detect_credential_dumping_through_lsass_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md b/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md
index b0ba58deb9..69d4ec50a4 100644
--- a/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md
+++ b/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md
@@ -113,8 +113,8 @@ This search looks for reading loaded Images unique to credential dumping with Mi
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 Note that **detect_mimikatz_using_loaded_images_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md b/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md
index 19c8bc230a..fc550147a8 100644
--- a/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md
+++ b/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md
@@ -111,8 +111,8 @@ Detect memory dumping of the LSASS process.
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 Note that **access_lsass_memory_for_dump_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md b/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md
index 5946b6f4b2..8aa14d73c6 100644
--- a/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md
+++ b/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md
@@ -111,8 +111,8 @@ Detect remote thread creation into LSASS consistent with credential dumping.
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 Note that **create_remote_thread_into_lsass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2019-12-06-unsigned_image_loaded_by_lsass.md b/docs/_posts/2019-12-06-unsigned_image_loaded_by_lsass.md
index 38606d00cd..19cc20b9a4 100644
--- a/docs/_posts/2019-12-06-unsigned_image_loaded_by_lsass.md
+++ b/docs/_posts/2019-12-06-unsigned_image_loaded_by_lsass.md
@@ -106,8 +106,8 @@ This search detects loading of unsigned images by LSASS. Deprecated because too
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 Note that **unsigned_image_loaded_by_lsass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md b/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md
index 796c176592..00906a59b0 100644
--- a/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md
+++ b/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md
@@ -172,4 +172,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/experimental/network/dns_query_length_outliers_-_mltk.yml) \| *version*: **2**
\ No newline at end of file
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/experimental/network/dns_query_length_outliers___mltk.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md b/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md
index a964f7ba27..443884aedb 100644
--- a/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md
+++ b/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md
@@ -111,8 +111,8 @@ Detect the hands on keyboard behavior of Windows Task Manager creating a process
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 Note that **creation_of_lsass_dump_with_taskmgr_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-02-07-ec2_instance_started_with_previously_unseen_instance_type.md b/docs/_posts/2020-02-07-ec2_instance_started_with_previously_unseen_instance_type.md
index 43dc1ecf84..3d6d3bd303 100644
--- a/docs/_posts/2020-02-07-ec2_instance_started_with_previously_unseen_instance_type.md
+++ b/docs/_posts/2020-02-07-ec2_instance_started_with_previously_unseen_instance_type.md
@@ -108,8 +108,8 @@ This search looks for EC2 instances being created with previously unseen instanc
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that **ec2_instance_started_with_previously_unseen_instance_type_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-02-07-macos_-_re-opened_applications.md b/docs/_posts/2020-02-07-macos_-_re-opened_applications.md
index dafdaa43af..ac4afeca5e 100644
--- a/docs/_posts/2020-02-07-macos_-_re-opened_applications.md
+++ b/docs/_posts/2020-02-07-macos_-_re-opened_applications.md
@@ -145,4 +145,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/experimental/endpoint/macos_-_re-opened_applications.yml) \| *version*: **1**
\ No newline at end of file
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/experimental/endpoint/macos___re_opened_applications.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md b/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md
index c053d777a3..21a716fc3f 100644
--- a/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md
+++ b/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md
@@ -113,8 +113,8 @@ Detect the usage of comsvcs.dll for dumping the lsass process.
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **dump_lsass_via_comsvcs_dll_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-03-16-detect_rare_executables.md b/docs/_posts/2020-03-16-detect_rare_executables.md
index e3eb455fb4..274121e762 100644
--- a/docs/_posts/2020-03-16-detect_rare_executables.md
+++ b/docs/_posts/2020-03-16-detect_rare_executables.md
@@ -113,8 +113,8 @@ This search will return a table of rare processes, the names of the systems runn
 
 #### Macros
 The SPL above uses the following Macros:
-* [filter_rare_process_allow_list](https://github.com/splunk/security_content/blob/develop/macros/filter_rare_process_allow_list.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [filter_rare_process_allow_list](https://github.com/splunk/security_content/blob/develop/macros/filter_rare_process_allow_list.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **detect_rare_executables_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-04-15-gcp_kubernetes_cluster_scan_detection.md b/docs/_posts/2020-04-15-gcp_kubernetes_cluster_scan_detection.md
index 62c22beed4..4203ca40fa 100644
--- a/docs/_posts/2020-04-15-gcp_kubernetes_cluster_scan_detection.md
+++ b/docs/_posts/2020-04-15-gcp_kubernetes_cluster_scan_detection.md
@@ -102,8 +102,8 @@ This search provides information of unauthenticated requests via user agent, and
 
 #### Macros
 The SPL above uses the following Macros:
-* [google_gcp_pubsub_message](https://github.com/splunk/security_content/blob/develop/macros/google_gcp_pubsub_message.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [google_gcp_pubsub_message](https://github.com/splunk/security_content/blob/develop/macros/google_gcp_pubsub_message.yml)
 
 Note that **gcp_kubernetes_cluster_scan_detection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md b/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md
index 4849af75ee..d79054926c 100644
--- a/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md
+++ b/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md
@@ -113,9 +113,9 @@ This search looks for child processes spawned by zoom.exe or zoom.us that has no
 
 #### Macros
 The SPL above uses the following Macros:
+* [previously_seen_zoom_child_processes_window](https://github.com/splunk/security_content/blob/develop/macros/previously_seen_zoom_child_processes_window.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [previously_seen_zoom_child_processes_window](https://github.com/splunk/security_content/blob/develop/macros/previously_seen_zoom_child_processes_window.yml)
 
 Note that **first_time_seen_child_process_of_zoom_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-07-06-windows_event_log_cleared.md b/docs/_posts/2020-07-06-windows_event_log_cleared.md
index 082d9f1dc2..3ef25ec2b7 100644
--- a/docs/_posts/2020-07-06-windows_event_log_cleared.md
+++ b/docs/_posts/2020-07-06-windows_event_log_cleared.md
@@ -115,8 +115,8 @@ The following analytic utilizes Windows Security Event ID 1102 or System log eve
 
 #### Macros
 The SPL above uses the following Macros:
-* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml)
 * [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
 
 Note that **windows_event_log_cleared_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-21-abnormally_high_aws_instances_launched_by_user_-_mltk.md b/docs/_posts/2020-07-21-abnormally_high_aws_instances_launched_by_user_-_mltk.md
index d421f248a0..d0aaad6c29 100644
--- a/docs/_posts/2020-07-21-abnormally_high_aws_instances_launched_by_user_-_mltk.md
+++ b/docs/_posts/2020-07-21-abnormally_high_aws_instances_launched_by_user_-_mltk.md
@@ -149,4 +149,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user_-_mltk.yml) \| *version*: **2**
\ No newline at end of file
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2020-07-21-abnormally_high_aws_instances_terminated_by_user_-_mltk.md b/docs/_posts/2020-07-21-abnormally_high_aws_instances_terminated_by_user_-_mltk.md
index 234156fdbb..4de3c9f318 100644
--- a/docs/_posts/2020-07-21-abnormally_high_aws_instances_terminated_by_user_-_mltk.md
+++ b/docs/_posts/2020-07-21-abnormally_high_aws_instances_terminated_by_user_-_mltk.md
@@ -148,4 +148,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user_-_mltk.yml) \| *version*: **2**
\ No newline at end of file
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2020-07-21-detect_aws_api_activities_from_unapproved_accounts.md b/docs/_posts/2020-07-21-detect_aws_api_activities_from_unapproved_accounts.md
index 8577bf1e0b..6060e39577 100644
--- a/docs/_posts/2020-07-21-detect_aws_api_activities_from_unapproved_accounts.md
+++ b/docs/_posts/2020-07-21-detect_aws_api_activities_from_unapproved_accounts.md
@@ -118,8 +118,8 @@ This search looks for successful AWS CloudTrail activity by user accounts that a
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that **detect_aws_api_activities_from_unapproved_accounts_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md b/docs/_posts/2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md
index e4c5adb515..4130b9ca3a 100644
--- a/docs/_posts/2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md
+++ b/docs/_posts/2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md
@@ -123,14 +123,14 @@ This search looks for DNS requests for phishing domains that are leveraging Evil
 
 #### Macros
 The SPL above uses the following Macros:
-* [evilginx_phishlets_0365](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_0365.yml)
-* [evilginx_phishlets_outlook](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_outlook.yml)
-* [evilginx_phishlets_aws](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_aws.yml)
 * [evilginx_phishlets_google](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_google.yml)
-* [evilginx_phishlets_facebook](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_facebook.yml)
 * [evilginx_phishlets_amazon](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_amazon.yml)
+* [evilginx_phishlets_facebook](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_facebook.yml)
+* [evilginx_phishlets_0365](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_0365.yml)
 * [evilginx_phishlets_github](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_github.yml)
+* [evilginx_phishlets_aws](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_aws.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [evilginx_phishlets_outlook](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_outlook.yml)
 
 Note that **detect_dns_requests_to_phishing_sites_leveraging_evilginx2_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-07-21-detect_new_user_aws_console_login.md b/docs/_posts/2020-07-21-detect_new_user_aws_console_login.md
index 273ce7537d..9a11a10b9e 100644
--- a/docs/_posts/2020-07-21-detect_new_user_aws_console_login.md
+++ b/docs/_posts/2020-07-21-detect_new_user_aws_console_login.md
@@ -113,8 +113,8 @@ This search looks for AWS CloudTrail events wherein a console login event by a u
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that **detect_new_user_aws_console_login_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-07-21-detect_web_traffic_to_dynamic_domain_providers.md b/docs/_posts/2020-07-21-detect_web_traffic_to_dynamic_domain_providers.md
index 421de97085..8c6c2210ad 100644
--- a/docs/_posts/2020-07-21-detect_web_traffic_to_dynamic_domain_providers.md
+++ b/docs/_posts/2020-07-21-detect_web_traffic_to_dynamic_domain_providers.md
@@ -109,8 +109,8 @@ This search looks for web connections to dynamic DNS providers.
 
 #### Macros
 The SPL above uses the following Macros:
-* [dynamic_dns_web_traffic](https://github.com/splunk/security_content/blob/develop/macros/dynamic_dns_web_traffic.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [dynamic_dns_web_traffic](https://github.com/splunk/security_content/blob/develop/macros/dynamic_dns_web_traffic.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **detect_web_traffic_to_dynamic_domain_providers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-21-ec2_instance_modified_with_previously_unseen_user.md b/docs/_posts/2020-07-21-ec2_instance_modified_with_previously_unseen_user.md
index 2e5b3f6302..cf2dd06696 100644
--- a/docs/_posts/2020-07-21-ec2_instance_modified_with_previously_unseen_user.md
+++ b/docs/_posts/2020-07-21-ec2_instance_modified_with_previously_unseen_user.md
@@ -118,9 +118,9 @@ This search looks for EC2 instances being modified by users who have not previou
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [ec2_modification_api_calls](https://github.com/splunk/security_content/blob/develop/macros/ec2_modification_api_calls.yml)
 * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that **ec2_instance_modified_with_previously_unseen_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-07-21-ec2_instance_started_with_previously_unseen_user.md b/docs/_posts/2020-07-21-ec2_instance_started_with_previously_unseen_user.md
index 7e2df37260..c91ae03d9a 100644
--- a/docs/_posts/2020-07-21-ec2_instance_started_with_previously_unseen_user.md
+++ b/docs/_posts/2020-07-21-ec2_instance_started_with_previously_unseen_user.md
@@ -117,8 +117,8 @@ This search looks for EC2 instances being created by users who have not created
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that **ec2_instance_started_with_previously_unseen_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md b/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md
index 4a0ec89d6b..a88f157eb2 100644
--- a/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md
+++ b/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md
@@ -116,8 +116,8 @@ This search looks for PowerShell processes started with parameters used to bypas
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **malicious_powershell_process_-_execution_policy_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -169,4 +169,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/malicious_powershell_process_-_execution_policy_bypass.yml) \| *version*: **5**
\ No newline at end of file
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml) \| *version*: **5**
\ No newline at end of file
diff --git a/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md b/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md
index 0d4ae796db..326187b09a 100644
--- a/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md
+++ b/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md
@@ -119,8 +119,8 @@ This search detects Okta login failures due to bad credentials for multiple user
 
 #### Macros
 The SPL above uses the following Macros:
-* [okta](https://github.com/splunk/security_content/blob/develop/macros/okta.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [okta](https://github.com/splunk/security_content/blob/develop/macros/okta.yml)
 
 Note that **multiple_okta_users_with_invalid_credentials_from_the_same_ip_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-07-21-okta_failed_sso_attempts.md b/docs/_posts/2020-07-21-okta_failed_sso_attempts.md
index ed1e9a3086..cc03763381 100644
--- a/docs/_posts/2020-07-21-okta_failed_sso_attempts.md
+++ b/docs/_posts/2020-07-21-okta_failed_sso_attempts.md
@@ -117,8 +117,8 @@ Detect failed Okta SSO events
 
 #### Macros
 The SPL above uses the following Macros:
-* [okta](https://github.com/splunk/security_content/blob/develop/macros/okta.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [okta](https://github.com/splunk/security_content/blob/develop/macros/okta.yml)
 
 Note that **okta_failed_sso_attempts_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md b/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md
index e628063e6e..0cd59c7473 100644
--- a/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md
+++ b/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md
@@ -118,8 +118,8 @@ This search detects logins from the same user from different cities in a 24 hour
 
 #### Macros
 The SPL above uses the following Macros:
-* [okta](https://github.com/splunk/security_content/blob/develop/macros/okta.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [okta](https://github.com/splunk/security_content/blob/develop/macros/okta.yml)
 
 Note that **okta_user_logins_from_multiple_cities_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-07-22-smb_traffic_spike_-_mltk.md b/docs/_posts/2020-07-22-smb_traffic_spike_-_mltk.md
index 5ce11663b5..c038526c69 100644
--- a/docs/_posts/2020-07-22-smb_traffic_spike_-_mltk.md
+++ b/docs/_posts/2020-07-22-smb_traffic_spike_-_mltk.md
@@ -164,4 +164,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/experimental/network/smb_traffic_spike_-_mltk.yml) \| *version*: **3**
\ No newline at end of file
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/experimental/network/smb_traffic_spike___mltk.yml) \| *version*: **3**
\ No newline at end of file
diff --git a/docs/_posts/2020-07-22-suspicious_email_-_uba_anomaly.md b/docs/_posts/2020-07-22-suspicious_email_-_uba_anomaly.md
index ecc4abba68..c1952a3520 100644
--- a/docs/_posts/2020-07-22-suspicious_email_-_uba_anomaly.md
+++ b/docs/_posts/2020-07-22-suspicious_email_-_uba_anomaly.md
@@ -144,4 +144,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/deprecated/suspicious_email_-_uba_anomaly.yml) \| *version*: **3**
\ No newline at end of file
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/deprecated/suspicious_email___uba_anomaly.yml) \| *version*: **3**
\ No newline at end of file
diff --git a/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md b/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md
index 8391395e2d..1022e2dcf1 100644
--- a/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md
+++ b/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md
@@ -117,8 +117,8 @@ This search looks for emails that have attachments with suspicious file extensio
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [suspicious_email_attachments](https://github.com/splunk/security_content/blob/develop/macros/suspicious_email_attachments.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **suspicious_email_attachment_extensions_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-22-suspicious_writes_to_system_volume_information.md b/docs/_posts/2020-07-22-suspicious_writes_to_system_volume_information.md
index 5a1aa00ddb..47ebc94eed 100644
--- a/docs/_posts/2020-07-22-suspicious_writes_to_system_volume_information.md
+++ b/docs/_posts/2020-07-22-suspicious_writes_to_system_volume_information.md
@@ -104,8 +104,8 @@ This search detects writes to the 'System Volume Information' folder by somethin
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 Note that **suspicious_writes_to_system_volume_information_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-07-22-uncommon_processes_on_endpoint.md b/docs/_posts/2020-07-22-uncommon_processes_on_endpoint.md
index a29e56797d..d7888da8d5 100644
--- a/docs/_posts/2020-07-22-uncommon_processes_on_endpoint.md
+++ b/docs/_posts/2020-07-22-uncommon_processes_on_endpoint.md
@@ -109,8 +109,8 @@ This search looks for applications on the endpoint that you have marked as uncom
 #### Macros
 The SPL above uses the following Macros:
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [uncommon_processes](https://github.com/splunk/security_content/blob/develop/macros/uncommon_processes.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **uncommon_processes_on_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md b/docs/_posts/2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md
index 63c1f1e698..e828ed3178 100644
--- a/docs/_posts/2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md
+++ b/docs/_posts/2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md
@@ -151,4 +151,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/experimental/web/detect_f5_tmui_rce_cve-2020-5902.yml) \| *version*: **1**
\ No newline at end of file
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/experimental/web/detect_f5_tmui_rce_cve_2020_5902.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2020-08-11-detect_arp_poisoning.md b/docs/_posts/2020-08-11-detect_arp_poisoning.md
index 9bad7b85c1..adcada45d6 100644
--- a/docs/_posts/2020-08-11-detect_arp_poisoning.md
+++ b/docs/_posts/2020-08-11-detect_arp_poisoning.md
@@ -128,8 +128,8 @@ By enabling Dynamic ARP Inspection as a Layer 2 Security measure on the organiza
 
 #### Macros
 The SPL above uses the following Macros:
-* [cisco_networks](https://github.com/splunk/security_content/blob/develop/macros/cisco_networks.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cisco_networks](https://github.com/splunk/security_content/blob/develop/macros/cisco_networks.yml)
 
 Note that **detect_arp_poisoning_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md b/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md
index f57584d02f..e2d06d01f7 100644
--- a/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md
+++ b/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md
@@ -121,8 +121,8 @@ By enabling DHCP Snooping as a Layer 2 Security measure on the organization's ne
 
 #### Macros
 The SPL above uses the following Macros:
-* [cisco_networks](https://github.com/splunk/security_content/blob/develop/macros/cisco_networks.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cisco_networks](https://github.com/splunk/security_content/blob/develop/macros/cisco_networks.yml)
 
 Note that **detect_rogue_dhcp_server_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-09-08-cloud_network_access_control_list_deleted.md b/docs/_posts/2020-09-08-cloud_network_access_control_list_deleted.md
index ff803f6754..8e6d952edd 100644
--- a/docs/_posts/2020-09-08-cloud_network_access_control_list_deleted.md
+++ b/docs/_posts/2020-09-08-cloud_network_access_control_list_deleted.md
@@ -98,8 +98,8 @@ Enforcing network-access controls is one of the defensive mechanisms used by clo
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that **cloud_network_access_control_list_deleted_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md b/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md
index f75b40d407..76955aa4d3 100644
--- a/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md
+++ b/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md
@@ -130,8 +130,8 @@ By enabling IPv6 First Hop Security as a Layer 2 Security measure on the organiz
 
 #### Macros
 The SPL above uses the following Macros:
-* [cisco_networks](https://github.com/splunk/security_content/blob/develop/macros/cisco_networks.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cisco_networks](https://github.com/splunk/security_content/blob/develop/macros/cisco_networks.yml)
 
 Note that **detect_ipv6_network_infrastructure_threats_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-10-28-detect_port_security_violation.md b/docs/_posts/2020-10-28-detect_port_security_violation.md
index 71e5f21e2a..27c6c5bc51 100644
--- a/docs/_posts/2020-10-28-detect_port_security_violation.md
+++ b/docs/_posts/2020-10-28-detect_port_security_violation.md
@@ -129,8 +129,8 @@ By enabling Port Security on a Cisco switch you can restrict input to an interfa
 
 #### Macros
 The SPL above uses the following Macros:
-* [cisco_networks](https://github.com/splunk/security_content/blob/develop/macros/cisco_networks.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cisco_networks](https://github.com/splunk/security_content/blob/develop/macros/cisco_networks.yml)
 
 Note that **detect_port_security_violation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-10-28-detect_traffic_mirroring.md b/docs/_posts/2020-10-28-detect_traffic_mirroring.md
index f8405f4c7e..0ff385644e 100644
--- a/docs/_posts/2020-10-28-detect_traffic_mirroring.md
+++ b/docs/_posts/2020-10-28-detect_traffic_mirroring.md
@@ -124,8 +124,8 @@ Adversaries may leverage traffic mirroring in order to automate data exfiltratio
 
 #### Macros
 The SPL above uses the following Macros:
-* [cisco_networks](https://github.com/splunk/security_content/blob/develop/macros/cisco_networks.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cisco_networks](https://github.com/splunk/security_content/blob/develop/macros/cisco_networks.yml)
 
 Note that **detect_traffic_mirroring_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-11-09-common_ransomware_extensions.md b/docs/_posts/2020-11-09-common_ransomware_extensions.md
index cfe00e44ed..5f32f9e04c 100644
--- a/docs/_posts/2020-11-09-common_ransomware_extensions.md
+++ b/docs/_posts/2020-11-09-common_ransomware_extensions.md
@@ -109,8 +109,8 @@ The search looks for file modifications with extensions commonly used by Ransomw
 
 #### Macros
 The SPL above uses the following Macros:
-* [ransomware_extensions](https://github.com/splunk/security_content/blob/develop/macros/ransomware_extensions.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [ransomware_extensions](https://github.com/splunk/security_content/blob/develop/macros/ransomware_extensions.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **common_ransomware_extensions_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-11-09-common_ransomware_notes.md b/docs/_posts/2020-11-09-common_ransomware_notes.md
index 881804c474..d9863180de 100644
--- a/docs/_posts/2020-11-09-common_ransomware_notes.md
+++ b/docs/_posts/2020-11-09-common_ransomware_notes.md
@@ -108,8 +108,8 @@ The search looks for files created with names matching those typically used in r
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [ransomware_notes](https://github.com/splunk/security_content/blob/develop/macros/ransomware_notes.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **common_ransomware_notes_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md b/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md
index 7c3f0e4f0c..b0998a4e68 100644
--- a/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md
+++ b/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md
@@ -113,8 +113,8 @@ This search looks for fast execution of processes used for system network config
 
 #### Macros
 The SPL above uses the following Macros:
-* [system_network_configuration_discovery_tools](https://github.com/splunk/security_content/blob/develop/macros/system_network_configuration_discovery_tools.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [system_network_configuration_discovery_tools](https://github.com/splunk/security_content/blob/develop/macros/system_network_configuration_discovery_tools.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **detect_processes_used_for_system_network_configuration_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md b/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md
index 31977e6ae7..0ff4508f1f 100644
--- a/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md
+++ b/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md
@@ -113,9 +113,9 @@ This search looks for executions of cmd.exe spawned by a process that is often a
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [prohibited_apps_launching_cmd](https://github.com/splunk/security_content/blob/develop/macros/prohibited_apps_launching_cmd.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **detect_prohibited_applications_spawning_cmd_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md b/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md
index b38e8a9e01..197647ea9c 100644
--- a/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md
+++ b/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md
@@ -115,9 +115,9 @@ During triage, review the parallel processes - what process moved the native Win
 
 #### Macros
 The SPL above uses the following Macros:
+* [is_windows_system_file](https://github.com/splunk/security_content/blob/develop/macros/is_windows_system_file.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [is_windows_system_file](https://github.com/splunk/security_content/blob/develop/macros/is_windows_system_file.yml)
 
 Note that **system_processes_run_from_unexpected_locations_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-12-08-wmi_permanent_event_subscription_-_sysmon.md b/docs/_posts/2020-12-08-wmi_permanent_event_subscription_-_sysmon.md
index 7d6bea5162..0b5044b9fc 100644
--- a/docs/_posts/2020-12-08-wmi_permanent_event_subscription_-_sysmon.md
+++ b/docs/_posts/2020-12-08-wmi_permanent_event_subscription_-_sysmon.md
@@ -172,4 +172,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/wmi_permanent_event_subscription_-_sysmon.yml) \| *version*: **3**
\ No newline at end of file
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml) \| *version*: **3**
\ No newline at end of file
diff --git a/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md b/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md
index 0aa0abaa98..58d9b858c1 100644
--- a/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md
+++ b/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md
@@ -110,8 +110,8 @@ The malware sunburst will load the malicious dll by SolarWinds.BusinessLayerHost
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 Note that **sunburst_correlation_dll_and_network_event_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-01-11-aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.md b/docs/_posts/2021-01-11-aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.md
index 0e2c303a9a..32c4fc9331 100644
--- a/docs/_posts/2021-01-11-aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.md
+++ b/docs/_posts/2021-01-11-aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.md
@@ -107,8 +107,8 @@ This search provides detection of KMS keys where action kms:Encrypt is accessibl
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that **aws_detect_users_creating_keys_with_encrypt_policy_without_mfa_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-01-11-aws_detect_users_with_kms_keys_performing_encryption_s3.md b/docs/_posts/2021-01-11-aws_detect_users_with_kms_keys_performing_encryption_s3.md
index ea27ea6f41..aa8a2bf23f 100644
--- a/docs/_posts/2021-01-11-aws_detect_users_with_kms_keys_performing_encryption_s3.md
+++ b/docs/_posts/2021-01-11-aws_detect_users_with_kms_keys_performing_encryption_s3.md
@@ -101,8 +101,8 @@ This search provides detection of users with KMS keys performing encryption spec
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that **aws_detect_users_with_kms_keys_performing_encryption_s3_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-01-11-aws_network_access_control_list_created_with_all_open_ports.md b/docs/_posts/2021-01-11-aws_network_access_control_list_created_with_all_open_ports.md
index a20843401c..c3854cdbd8 100644
--- a/docs/_posts/2021-01-11-aws_network_access_control_list_created_with_all_open_ports.md
+++ b/docs/_posts/2021-01-11-aws_network_access_control_list_created_with_all_open_ports.md
@@ -114,8 +114,8 @@ The search looks for AWS CloudTrail events to detect if any network ACLs were cr
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that **aws_network_access_control_list_created_with_all_open_ports_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-01-12-aws_network_access_control_list_deleted.md b/docs/_posts/2021-01-12-aws_network_access_control_list_deleted.md
index 74562f94e1..6a01a575a2 100644
--- a/docs/_posts/2021-01-12-aws_network_access_control_list_deleted.md
+++ b/docs/_posts/2021-01-12-aws_network_access_control_list_deleted.md
@@ -111,8 +111,8 @@ Enforcing network-access controls is one of the defensive mechanisms used by clo
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that **aws_network_access_control_list_deleted_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md b/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md
index b436710a79..9118685a62 100644
--- a/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md
+++ b/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md
@@ -118,8 +118,8 @@ This search looks for PowerShell processes launched with arguments that have cha
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **malicious_powershell_process_with_obfuscation_techniques_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-01-19-suspicious_powershell_command-line_arguments.md b/docs/_posts/2021-01-19-suspicious_powershell_command-line_arguments.md
index 7854cec1cf..a34b809964 100644
--- a/docs/_posts/2021-01-19-suspicious_powershell_command-line_arguments.md
+++ b/docs/_posts/2021-01-19-suspicious_powershell_command-line_arguments.md
@@ -149,4 +149,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/deprecated/suspicious_powershell_command-line_arguments.yml) \| *version*: **6**
\ No newline at end of file
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/deprecated/suspicious_powershell_command_line_arguments.yml) \| *version*: **6**
\ No newline at end of file
diff --git a/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md b/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md
index 9d200b9c67..aa7ca6e533 100644
--- a/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md
+++ b/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md
@@ -112,8 +112,8 @@ The following analytic identifies "rundll32.exe" execution with inline protocol
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **detect_rundll32_inline_hta_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-01-26-aws_saml_access_by_provider_user_and_principal.md b/docs/_posts/2021-01-26-aws_saml_access_by_provider_user_and_principal.md
index a33efb5185..c659f13c37 100644
--- a/docs/_posts/2021-01-26-aws_saml_access_by_provider_user_and_principal.md
+++ b/docs/_posts/2021-01-26-aws_saml_access_by_provider_user_and_principal.md
@@ -103,8 +103,8 @@ This search provides specific SAML access from specific Service Provider, user a
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that **aws_saml_access_by_provider_user_and_principal_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-01-26-aws_saml_update_identity_provider.md b/docs/_posts/2021-01-26-aws_saml_update_identity_provider.md
index 12b3589f24..a8e75ff12f 100644
--- a/docs/_posts/2021-01-26-aws_saml_update_identity_provider.md
+++ b/docs/_posts/2021-01-26-aws_saml_update_identity_provider.md
@@ -103,8 +103,8 @@ This search provides detection of updates to SAML provider in AWS. Updates to SA
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that **aws_saml_update_identity_provider_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-01-27-detect_baron_samedit_cve-2021-3156.md b/docs/_posts/2021-01-27-detect_baron_samedit_cve-2021-3156.md
index 60717f1851..e35de0fc20 100644
--- a/docs/_posts/2021-01-27-detect_baron_samedit_cve-2021-3156.md
+++ b/docs/_posts/2021-01-27-detect_baron_samedit_cve-2021-3156.md
@@ -147,4 +147,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/experimental/endpoint/detect_baron_samedit_cve-2021-3156.yml) \| *version*: **1**
\ No newline at end of file
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/experimental/endpoint/detect_baron_samedit_cve_2021_3156.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md b/docs/_posts/2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md
index 66b6df2011..91ddf2a76c 100644
--- a/docs/_posts/2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md
+++ b/docs/_posts/2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md
@@ -148,4 +148,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/experimental/endpoint/detect_baron_samedit_cve-2021-3156_via_osquery.yml) \| *version*: **1**
\ No newline at end of file
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/experimental/endpoint/detect_baron_samedit_cve_2021_3156_via_osquery.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md b/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md
index 97a85c9898..ed317857d0 100644
--- a/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md
+++ b/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md
@@ -114,8 +114,8 @@ Upon investigating, look for network connections to remote destinations (interna
 #### Macros
 The SPL above uses the following Macros:
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **detect_regsvr32_application_control_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md b/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md
index c4c4425d81..a693bd7784 100644
--- a/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md
+++ b/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md
@@ -113,8 +113,8 @@ Adversaries may abuse Regsvr32.exe to proxy execution of malicious code by using
 #### Macros
 The SPL above uses the following Macros:
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **suspicious_regsvr32_register_suspicious_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md b/docs/_posts/2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md
index 758d09be03..ccb3f80946 100644
--- a/docs/_posts/2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md
+++ b/docs/_posts/2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md
@@ -150,4 +150,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/experimental/endpoint/detect_baron_samedit_cve-2021-3156_segfault.yml) \| *version*: **1**
\ No newline at end of file
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/experimental/endpoint/detect_baron_samedit_cve_2021_3156_segfault.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2021-02-01-dump_lsass_via_procdump_rename.md b/docs/_posts/2021-02-01-dump_lsass_via_procdump_rename.md
index b199cbcbe9..98eeed668c 100644
--- a/docs/_posts/2021-02-01-dump_lsass_via_procdump_rename.md
+++ b/docs/_posts/2021-02-01-dump_lsass_via_procdump_rename.md
@@ -108,8 +108,8 @@ During triage, confirm this is procdump.exe executing. If it is the first time a
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 Note that **dump_lsass_via_procdump_rename_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md
index e20162ef63..a80aae3e91 100644
--- a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md
+++ b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md
@@ -112,8 +112,8 @@ The following analytic identifies rundll32.exe loading advpack.dll and ieadvpack
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **detect_rundll32_application_control_bypass_-_advpack_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -172,4 +172,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/detect_rundll32_application_control_bypass_-_advpack.yml) \| *version*: **2**
\ No newline at end of file
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md
index a16c922a53..aaf6a86329 100644
--- a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md
+++ b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md
@@ -112,8 +112,8 @@ The following analytic identifies rundll32.exe loading setupapi.dll and iesetupa
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **detect_rundll32_application_control_bypass_-_setupapi_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -172,4 +172,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/detect_rundll32_application_control_bypass_-_setupapi.yml) \| *version*: **2**
\ No newline at end of file
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md
index bfc46a0183..1a4a872fe2 100644
--- a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md
+++ b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md
@@ -112,8 +112,8 @@ The following analytic identifies rundll32.exe loading syssetup.dll by calling t
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **detect_rundll32_application_control_bypass_-_syssetup_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -172,4 +172,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/detect_rundll32_application_control_bypass_-_syssetup.yml) \| *version*: **2**
\ No newline at end of file
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2021-02-04-suspicious_rundll32_startw.md b/docs/_posts/2021-02-04-suspicious_rundll32_startw.md
index 5cd183d4a2..7f890de882 100644
--- a/docs/_posts/2021-02-04-suspicious_rundll32_startw.md
+++ b/docs/_posts/2021-02-04-suspicious_rundll32_startw.md
@@ -112,8 +112,8 @@ The following analytic identifies rundll32.exe executing a DLL function name, St
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **suspicious_rundll32_startw_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md b/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md
index 95505527e0..3ce4102d72 100644
--- a/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md
+++ b/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md
@@ -112,8 +112,8 @@ The following analytic identifies rundll32.exe using dllregisterserver on the co
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **suspicious_rundll32_dllregisterserver_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-02-22-aws_create_policy_version_to_allow_all_resources.md b/docs/_posts/2021-02-22-aws_create_policy_version_to_allow_all_resources.md
index 5fddfe8ebe..f2b5767364 100644
--- a/docs/_posts/2021-02-22-aws_create_policy_version_to_allow_all_resources.md
+++ b/docs/_posts/2021-02-22-aws_create_policy_version_to_allow_all_resources.md
@@ -121,8 +121,8 @@ This search looks for AWS CloudTrail events where a user created a policy versio
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that **aws_create_policy_version_to_allow_all_resources_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-02-22-cobalt_strike_named_pipes.md b/docs/_posts/2021-02-22-cobalt_strike_named_pipes.md
index 71a536bbeb..0e70fa2818 100644
--- a/docs/_posts/2021-02-22-cobalt_strike_named_pipes.md
+++ b/docs/_posts/2021-02-22-cobalt_strike_named_pipes.md
@@ -108,8 +108,8 @@ Upon triage, review the process performing the named pipe. If it is explorer.exe
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 Note that **cobalt_strike_named_pipes_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-03-01-any_powershell_downloadfile.md b/docs/_posts/2021-03-01-any_powershell_downloadfile.md
index 2338c9cafb..4d55178438 100644
--- a/docs/_posts/2021-03-01-any_powershell_downloadfile.md
+++ b/docs/_posts/2021-03-01-any_powershell_downloadfile.md
@@ -112,8 +112,8 @@ The following analytic identifies the use of PowerShell downloading a file using
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **any_powershell_downloadfile_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-03-01-any_powershell_downloadstring.md b/docs/_posts/2021-03-01-any_powershell_downloadstring.md
index 93f5ca4347..94e7a018b4 100644
--- a/docs/_posts/2021-03-01-any_powershell_downloadstring.md
+++ b/docs/_posts/2021-03-01-any_powershell_downloadstring.md
@@ -107,8 +107,8 @@ The following analytic identifies the use of PowerShell downloading a file using
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **any_powershell_downloadstring_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-03-02-aws_setdefaultpolicyversion.md b/docs/_posts/2021-03-02-aws_setdefaultpolicyversion.md
index 64a41e2444..e3c4503e8c 100644
--- a/docs/_posts/2021-03-02-aws_setdefaultpolicyversion.md
+++ b/docs/_posts/2021-03-02-aws_setdefaultpolicyversion.md
@@ -117,8 +117,8 @@ This search looks for AWS CloudTrail events where a user has set a default polic
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that **aws_setdefaultpolicyversion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-03-03-nishang_powershelltcponeline.md b/docs/_posts/2021-03-03-nishang_powershelltcponeline.md
index bacca10368..85370c1aea 100644
--- a/docs/_posts/2021-03-03-nishang_powershelltcponeline.md
+++ b/docs/_posts/2021-03-03-nishang_powershelltcponeline.md
@@ -107,8 +107,8 @@ This query detects the Nishang Invoke-PowerShellTCPOneLine utility that spawns a
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **nishang_powershelltcponeline_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-03-03-w3wp_spawning_shell.md b/docs/_posts/2021-03-03-w3wp_spawning_shell.md
index 15933a9847..aca9d2a2d1 100644
--- a/docs/_posts/2021-03-03-w3wp_spawning_shell.md
+++ b/docs/_posts/2021-03-03-w3wp_spawning_shell.md
@@ -116,9 +116,9 @@ This query identifies a shell, PowerShell.exe or Cmd.exe, spawning from W3WP.exe
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
-* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
+* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **w3wp_spawning_shell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md b/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md
index d459b46915..13b8c77cf1 100644
--- a/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md
+++ b/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md
@@ -103,8 +103,8 @@ The following analytics identifies a big number of instance of ransomware notes
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 Note that **ransomware_notes_bulk_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-03-16-high_process_termination_frequency.md b/docs/_posts/2021-03-16-high_process_termination_frequency.md
index e9a10ed2b3..895cad31c1 100644
--- a/docs/_posts/2021-03-16-high_process_termination_frequency.md
+++ b/docs/_posts/2021-03-16-high_process_termination_frequency.md
@@ -103,8 +103,8 @@ This analytics are designed to indentify a high frequency of process termination
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 Note that **high_process_termination_frequency_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-03-16-windows_high_file_deletion_frequency.md b/docs/_posts/2021-03-16-windows_high_file_deletion_frequency.md
index 5a565e980e..15fab392c7 100644
--- a/docs/_posts/2021-03-16-windows_high_file_deletion_frequency.md
+++ b/docs/_posts/2021-03-16-windows_high_file_deletion_frequency.md
@@ -102,8 +102,8 @@ This search looks for high frequency of file deletion relative to process name a
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 Note that **windows_high_file_deletion_frequency_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-03-17-clop_ransomware_known_service_name.md b/docs/_posts/2021-03-17-clop_ransomware_known_service_name.md
index 8b7470b10f..a0c77a5d05 100644
--- a/docs/_posts/2021-03-17-clop_ransomware_known_service_name.md
+++ b/docs/_posts/2021-03-17-clop_ransomware_known_service_name.md
@@ -102,8 +102,8 @@ This detection is to identify the common service name created by the CLOP ransom
 
 #### Macros
 The SPL above uses the following Macros:
-* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml)
 
 Note that **clop_ransomware_known_service_name_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-03-23-certutil_with_decode_argument.md b/docs/_posts/2021-03-23-certutil_with_decode_argument.md
index d5b0647d30..13a8277347 100644
--- a/docs/_posts/2021-03-23-certutil_with_decode_argument.md
+++ b/docs/_posts/2021-03-23-certutil_with_decode_argument.md
@@ -102,8 +102,8 @@ CertUtil.exe may be used to `encode` and `decode` a file, including PE and scrip
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **certutil_with_decode_argument_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-03-29-powershell_start-bitstransfer.md b/docs/_posts/2021-03-29-powershell_start-bitstransfer.md
index ace986afa6..64f85e737c 100644
--- a/docs/_posts/2021-03-29-powershell_start-bitstransfer.md
+++ b/docs/_posts/2021-03-29-powershell_start-bitstransfer.md
@@ -103,8 +103,8 @@ Start-BitsTransfer is the PowerShell "version" of BitsAdmin.exe. Similar functio
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **powershell_start-bitstransfer_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -159,4 +159,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/powershell_start-bitstransfer.yml) \| *version*: **2**
\ No newline at end of file
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/powershell_start_bitstransfer.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2021-03-31-aws_iam_successful_group_deletion.md b/docs/_posts/2021-03-31-aws_iam_successful_group_deletion.md
index 4c3a3cbd67..255d9f47a4 100644
--- a/docs/_posts/2021-03-31-aws_iam_successful_group_deletion.md
+++ b/docs/_posts/2021-03-31-aws_iam_successful_group_deletion.md
@@ -110,8 +110,8 @@ The following query uses IAM events to track the success of a group being delete
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that **aws_iam_successful_group_deletion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md b/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md
index d3e0b86e6a..59ff6b0c91 100644
--- a/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md
+++ b/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md
@@ -108,8 +108,8 @@ This search is to identifies suspicious firewall disabling using netsh applicati
 #### Macros
 The SPL above uses the following Macros:
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **disabling_firewall_with_netsh_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-04-01-aws_iam_assume_role_policy_brute_force.md b/docs/_posts/2021-04-01-aws_iam_assume_role_policy_brute_force.md
index 15947dcf4d..45408a589f 100644
--- a/docs/_posts/2021-04-01-aws_iam_assume_role_policy_brute_force.md
+++ b/docs/_posts/2021-04-01-aws_iam_assume_role_policy_brute_force.md
@@ -106,8 +106,8 @@ The following detection identifies any malformed policy document exceptions with
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that **aws_iam_assume_role_policy_brute_force_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-04-01-aws_iam_delete_policy.md b/docs/_posts/2021-04-01-aws_iam_delete_policy.md
index 1575dfd36a..e3d7e22345 100644
--- a/docs/_posts/2021-04-01-aws_iam_delete_policy.md
+++ b/docs/_posts/2021-04-01-aws_iam_delete_policy.md
@@ -100,8 +100,8 @@ The following detection identifes when a policy is deleted on AWS. This does not
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that **aws_iam_delete_policy_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-04-01-aws_iam_failure_group_deletion.md b/docs/_posts/2021-04-01-aws_iam_failure_group_deletion.md
index b793b9283d..00e4683600 100644
--- a/docs/_posts/2021-04-01-aws_iam_failure_group_deletion.md
+++ b/docs/_posts/2021-04-01-aws_iam_failure_group_deletion.md
@@ -100,8 +100,8 @@ This detection identifies failure attempts to delete groups. We want to identify
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that **aws_iam_failure_group_deletion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-04-07-malicious_powershell_executed_as_a_service.md b/docs/_posts/2021-04-07-malicious_powershell_executed_as_a_service.md
index ff16833ce2..d2943a0edb 100644
--- a/docs/_posts/2021-04-07-malicious_powershell_executed_as_a_service.md
+++ b/docs/_posts/2021-04-07-malicious_powershell_executed_as_a_service.md
@@ -115,8 +115,8 @@ This detection is to identify the abuse the Windows SC.exe to execute malicious
 
 #### Macros
 The SPL above uses the following Macros:
-* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml)
 
 Note that **malicious_powershell_executed_as_a_service_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-04-12-excel_spawning_powershell.md b/docs/_posts/2021-04-12-excel_spawning_powershell.md
index 8cedc3af8b..8769d24df3 100644
--- a/docs/_posts/2021-04-12-excel_spawning_powershell.md
+++ b/docs/_posts/2021-04-12-excel_spawning_powershell.md
@@ -107,8 +107,8 @@ The following detection identifies Microsoft Excel spawning PowerShell. Typicall
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **excel_spawning_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-04-12-winword_spawning_powershell.md b/docs/_posts/2021-04-12-winword_spawning_powershell.md
index f23543ca3a..9f2736cd5a 100644
--- a/docs/_posts/2021-04-12-winword_spawning_powershell.md
+++ b/docs/_posts/2021-04-12-winword_spawning_powershell.md
@@ -107,8 +107,8 @@ The following detection identifies Microsoft Word spawning PowerShell. Typically
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **winword_spawning_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-04-13-aws_excessive_security_scanning.md b/docs/_posts/2021-04-13-aws_excessive_security_scanning.md
index d6de864826..f2c20b14e6 100644
--- a/docs/_posts/2021-04-13-aws_excessive_security_scanning.md
+++ b/docs/_posts/2021-04-13-aws_excessive_security_scanning.md
@@ -107,8 +107,8 @@ This search looks for AWS CloudTrail events and analyse the amount of eventNames
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that **aws_excessive_security_scanning_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md b/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md
index b4c88e1ccc..6c3b38bfdd 100644
--- a/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md
+++ b/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md
@@ -107,8 +107,8 @@ this detection was designed to identifies suspicious spawned process of known MS
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **office_application_spawn_rundll32_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-04-14-office_document_creating_schedule_task.md b/docs/_posts/2021-04-14-office_document_creating_schedule_task.md
index e1df7ecf2f..2df2c08b22 100644
--- a/docs/_posts/2021-04-14-office_document_creating_schedule_task.md
+++ b/docs/_posts/2021-04-14-office_document_creating_schedule_task.md
@@ -106,8 +106,8 @@ this search detects a potential malicious office document that create schedule t
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 Note that **office_document_creating_schedule_task_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-04-14-office_document_executing_macro_code.md b/docs/_posts/2021-04-14-office_document_executing_macro_code.md
index 712dd21be0..4b21420204 100644
--- a/docs/_posts/2021-04-14-office_document_executing_macro_code.md
+++ b/docs/_posts/2021-04-14-office_document_executing_macro_code.md
@@ -106,8 +106,8 @@ this detection was designed to identifies suspicious office documents that using
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 Note that **office_document_executing_macro_code_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md b/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md
index 81a76ff8c8..c43e81b053 100644
--- a/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md
+++ b/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md
@@ -102,8 +102,8 @@ this search is designed to detect suspicious powershell process that tries to in
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 Note that **powershell_remote_thread_to_known_windows_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-04-19-wermgr_process_connecting_to_ip_check_web_services.md b/docs/_posts/2021-04-19-wermgr_process_connecting_to_ip_check_web_services.md
index 41f98dbe17..73bc6c0ec9 100644
--- a/docs/_posts/2021-04-19-wermgr_process_connecting_to_ip_check_web_services.md
+++ b/docs/_posts/2021-04-19-wermgr_process_connecting_to_ip_check_web_services.md
@@ -106,8 +106,8 @@ this search is designed to detect suspicious wermgr.exe process that tries to co
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 Note that **wermgr_process_connecting_to_ip_check_web_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md b/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md
index ba6c575f79..cd138f7ea3 100644
--- a/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md
+++ b/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md
@@ -101,8 +101,8 @@ this search is designed to detect potential malicious wermgr.exe process that dr
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 Note that **wermgr_process_create_executable_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md b/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md
index 8e8dbb9301..061b5193b6 100644
--- a/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md
+++ b/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md
@@ -102,9 +102,9 @@ This search is designed to detect suspicious cmd and powershell process spawned
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
-* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
+* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **wermgr_process_spawned_cmd_or_powershell_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-04-21-excessive_usage_of_nslookup_app.md b/docs/_posts/2021-04-21-excessive_usage_of_nslookup_app.md
index 1c79405b19..ed31a7793f 100644
--- a/docs/_posts/2021-04-21-excessive_usage_of_nslookup_app.md
+++ b/docs/_posts/2021-04-21-excessive_usage_of_nslookup_app.md
@@ -106,8 +106,8 @@ This search is to detect potential DNS exfiltration using nslookup application.
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 Note that **excessive_usage_of_nslookup_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-04-21-multiple_archive_files_http_post_traffic.md b/docs/_posts/2021-04-21-multiple_archive_files_http_post_traffic.md
index d753d5416f..1da816b5f4 100644
--- a/docs/_posts/2021-04-21-multiple_archive_files_http_post_traffic.md
+++ b/docs/_posts/2021-04-21-multiple_archive_files_http_post_traffic.md
@@ -109,8 +109,8 @@ This search is designed to detect high frequency of archive files data exfiltrat
 
 #### Macros
 The SPL above uses the following Macros:
-* [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml)
 
 Note that **multiple_archive_files_http_post_traffic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md b/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md
index a36c493b59..ce9b807814 100644
--- a/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md
+++ b/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md
@@ -107,8 +107,8 @@ The following detection identifies the latest behavior utilized by IcedID malwar
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **office_product_spawning_rundll32_with_no_dll_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-04-22-plain_http_post_exfiltrated_data.md b/docs/_posts/2021-04-22-plain_http_post_exfiltrated_data.md
index d0977c1006..b554f66150 100644
--- a/docs/_posts/2021-04-22-plain_http_post_exfiltrated_data.md
+++ b/docs/_posts/2021-04-22-plain_http_post_exfiltrated_data.md
@@ -106,8 +106,8 @@ This search is to detect potential plain HTTP POST method data exfiltration. Thi
 
 #### Macros
 The SPL above uses the following Macros:
-* [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml)
 
 Note that **plain_http_post_exfiltrated_data_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-04-22-winword_spawning_cmd.md b/docs/_posts/2021-04-22-winword_spawning_cmd.md
index 2939190510..72583d6da2 100644
--- a/docs/_posts/2021-04-22-winword_spawning_cmd.md
+++ b/docs/_posts/2021-04-22-winword_spawning_cmd.md
@@ -107,8 +107,8 @@ The following detection identifies Microsoft Word spawning `cmd.exe`. Typically,
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **winword_spawning_cmd_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md b/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md
index a4cd573df4..0a05d80c76 100644
--- a/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md
+++ b/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md
@@ -107,8 +107,8 @@ The following detection identifies the latest behavior utilized by different mal
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_bitsadmin](https://github.com/splunk/security_content/blob/develop/macros/process_bitsadmin.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_bitsadmin](https://github.com/splunk/security_content/blob/develop/macros/process_bitsadmin.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **office_product_spawning_bitsadmin_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-04-26-office_product_spawning_certutil.md b/docs/_posts/2021-04-26-office_product_spawning_certutil.md
index 4dc31dc3e2..8fb44b7307 100644
--- a/docs/_posts/2021-04-26-office_product_spawning_certutil.md
+++ b/docs/_posts/2021-04-26-office_product_spawning_certutil.md
@@ -107,8 +107,8 @@ The following detection identifies the latest behavior utilized by different mal
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **office_product_spawning_certutil_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-04-26-trickbot_named_pipe.md b/docs/_posts/2021-04-26-trickbot_named_pipe.md
index 0eadc14902..1158b6cf9a 100644
--- a/docs/_posts/2021-04-26-trickbot_named_pipe.md
+++ b/docs/_posts/2021-04-26-trickbot_named_pipe.md
@@ -102,8 +102,8 @@ this search is to detect potential trickbot infection through the create/connect
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 Note that **trickbot_named_pipe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md b/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md
index 4639b50b53..7db21c16a7 100644
--- a/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md
+++ b/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md
@@ -108,8 +108,8 @@ This analytic will detect suspicious driver loaded paths. This technique is comm
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 Note that **suspicious_driver_loaded_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-04-29-xmrig_driver_loaded.md b/docs/_posts/2021-04-29-xmrig_driver_loaded.md
index a8ebca20c2..0b79a8782f 100644
--- a/docs/_posts/2021-04-29-xmrig_driver_loaded.md
+++ b/docs/_posts/2021-04-29-xmrig_driver_loaded.md
@@ -108,8 +108,8 @@ This analytic identifies XMRIG coinminer driver installation on the system. The
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 Note that **xmrig_driver_loaded_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-05-06-download_files_using_telegram.md b/docs/_posts/2021-05-06-download_files_using_telegram.md
index 552c212ffa..a854bfb692 100644
--- a/docs/_posts/2021-05-06-download_files_using_telegram.md
+++ b/docs/_posts/2021-05-06-download_files_using_telegram.md
@@ -101,8 +101,8 @@ The following analytic will identify a suspicious download by the Telegram appli
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 Note that **download_files_using_telegram_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md b/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md
index 5f00a8936a..b0016a85a6 100644
--- a/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md
+++ b/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md
@@ -106,8 +106,8 @@ This analytic detects a potential process using COM Object like CMLUA or CMSTPLU
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 Note that **cmlua_or_cmstplua_uac_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md b/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md
index e9220a6f5f..7e7bbb16f4 100644
--- a/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md
+++ b/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md
@@ -119,8 +119,8 @@ This analytic identifies a common behavior by Cobalt Strike and other frameworks
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **cmd_echo_pipe_-_escalation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -175,4 +175,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/cmd_echo_pipe_-_escalation.yml) \| *version*: **2**
\ No newline at end of file
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/cmd_echo_pipe___escalation.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2021-06-01-detect_azurehound_command-line_arguments.md b/docs/_posts/2021-06-01-detect_azurehound_command-line_arguments.md
index 1d85446375..2f86780e5b 100644
--- a/docs/_posts/2021-06-01-detect_azurehound_command-line_arguments.md
+++ b/docs/_posts/2021-06-01-detect_azurehound_command-line_arguments.md
@@ -189,4 +189,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/detect_azurehound_command-line_arguments.yml) \| *version*: **1**
\ No newline at end of file
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/detect_azurehound_command_line_arguments.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2021-06-01-detect_sharphound_command-line_arguments.md b/docs/_posts/2021-06-01-detect_sharphound_command-line_arguments.md
index b9a9bf2a31..e2b9944f35 100644
--- a/docs/_posts/2021-06-01-detect_sharphound_command-line_arguments.md
+++ b/docs/_posts/2021-06-01-detect_sharphound_command-line_arguments.md
@@ -187,4 +187,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/detect_sharphound_command-line_arguments.yml) \| *version*: **1**
\ No newline at end of file
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/detect_sharphound_command_line_arguments.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2021-06-02-modification_of_wallpaper.md b/docs/_posts/2021-06-02-modification_of_wallpaper.md
index df6790b3d3..a296abe1a9 100644
--- a/docs/_posts/2021-06-02-modification_of_wallpaper.md
+++ b/docs/_posts/2021-06-02-modification_of_wallpaper.md
@@ -101,8 +101,8 @@ This analytic identifies suspicious modification of registry to deface or change
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 Note that **modification_of_wallpaper_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-06-02-wbemprox_com_object_execution.md b/docs/_posts/2021-06-02-wbemprox_com_object_execution.md
index b2016bf0c5..1e9dc12127 100644
--- a/docs/_posts/2021-06-02-wbemprox_com_object_execution.md
+++ b/docs/_posts/2021-06-02-wbemprox_com_object_execution.md
@@ -106,8 +106,8 @@ this search is designed to detect potential malicious process loading COM object
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 Note that **wbemprox_com_object_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-06-04-known_services_killed_by_ransomware.md b/docs/_posts/2021-06-04-known_services_killed_by_ransomware.md
index 8955a7020a..e03accc979 100644
--- a/docs/_posts/2021-06-04-known_services_killed_by_ransomware.md
+++ b/docs/_posts/2021-06-04-known_services_killed_by_ransomware.md
@@ -101,8 +101,8 @@ This search detects a suspicioous termination of known services killed by ransom
 
 #### Macros
 The SPL above uses the following Macros:
-* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml)
 
 Note that **known_services_killed_by_ransomware_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md b/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md
index 986c97fc50..fa06692d54 100644
--- a/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md
+++ b/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md
@@ -112,8 +112,8 @@ Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToCons
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 Note that **detect_wmi_event_subscription_persistence_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md b/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md
index f5be2dfb63..750e3d8fd9 100644
--- a/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md
+++ b/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md
@@ -107,8 +107,8 @@ This search is to detect a suspicious commandline designed to delete files or di
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **recursive_delete_of_directory_in_batch_cmd_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md b/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md
index f5c4db4a96..746eb1964a 100644
--- a/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md
+++ b/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md
@@ -108,8 +108,8 @@ This search is to detect a suspicious modification of firewall to allow file and
 #### Macros
 The SPL above uses the following Macros:
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **allow_file_and_printing_sharing_in_firewall_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md b/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md
index ce80c8adff..6e0637e396 100644
--- a/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md
+++ b/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md
@@ -108,8 +108,8 @@ This search is to detect a suspicious modification to the firewall to allow netw
 #### Macros
 The SPL above uses the following Macros:
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **allow_network_discovery_in_firewall_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md b/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md
index 12b22c558f..4750ec2ea0 100644
--- a/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md
+++ b/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md
@@ -111,8 +111,8 @@ This search is to detect a suspicious excessive usage of sc.exe in a host machin
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 Note that **excessive_usage_of_sc_service_utility_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-07-01-print_spooler_adding_a_printer_driver.md b/docs/_posts/2021-07-01-print_spooler_adding_a_printer_driver.md
index 39e80769c2..385e312b70 100644
--- a/docs/_posts/2021-07-01-print_spooler_adding_a_printer_driver.md
+++ b/docs/_posts/2021-07-01-print_spooler_adding_a_printer_driver.md
@@ -117,8 +117,8 @@ During triage, isolate the endpoint and review for source of exploitation. Captu
 
 #### Macros
 The SPL above uses the following Macros:
-* [printservice](https://github.com/splunk/security_content/blob/develop/macros/printservice.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [printservice](https://github.com/splunk/security_content/blob/develop/macros/printservice.yml)
 
 Note that **print_spooler_adding_a_printer_driver_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-07-01-print_spooler_failed_to_load_a_plug-in.md b/docs/_posts/2021-07-01-print_spooler_failed_to_load_a_plug-in.md
index 83cbd2e90b..2eb3ddd701 100644
--- a/docs/_posts/2021-07-01-print_spooler_failed_to_load_a_plug-in.md
+++ b/docs/_posts/2021-07-01-print_spooler_failed_to_load_a_plug-in.md
@@ -118,8 +118,8 @@ During triage, isolate the endpoint and review for source of exploitation. Captu
 
 #### Macros
 The SPL above uses the following Macros:
-* [printservice](https://github.com/splunk/security_content/blob/develop/macros/printservice.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [printservice](https://github.com/splunk/security_content/blob/develop/macros/printservice.yml)
 
 Note that **print_spooler_failed_to_load_a_plug-in_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
@@ -164,4 +164,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/print_spooler_failed_to_load_a_plug-in.yml) \| *version*: **1**
\ No newline at end of file
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md b/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md
index 96c5a05550..cd7527b79f 100644
--- a/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md
+++ b/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md
@@ -114,8 +114,8 @@ The following analytic identifies a suspicious child process, `rundll32.exe`, wi
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **spoolsv_spawning_rundll32_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md b/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md
index 3a912ebefc..dbce47b9c7 100644
--- a/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md
+++ b/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md
@@ -114,8 +114,8 @@ This search is to detect suspicious loading of dll in specific path relative to
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 Note that **spoolsv_suspicious_loaded_modules_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md b/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md
index f549313207..e28f396237 100644
--- a/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md
+++ b/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md
@@ -106,8 +106,8 @@ This analytic identifies a suspicious behavior related to PrintNightmare, or CVE
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 Note that **spoolsv_suspicious_process_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md b/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md
index f6d5b756f5..52f30c1349 100644
--- a/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md
+++ b/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md
@@ -113,8 +113,8 @@ The following analytic identifies a `.dll` being written by `spoolsv.exe`. This
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 Note that **spoolsv_writing_a_dll_-_sysmon_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
@@ -165,4 +165,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/spoolsv_writing_a_dll_-_sysmon.yml) \| *version*: **1**
\ No newline at end of file
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2021-07-05-powershell_disable_security_monitoring.md b/docs/_posts/2021-07-05-powershell_disable_security_monitoring.md
index d05b0aebbf..ae96cf1d74 100644
--- a/docs/_posts/2021-07-05-powershell_disable_security_monitoring.md
+++ b/docs/_posts/2021-07-05-powershell_disable_security_monitoring.md
@@ -107,8 +107,8 @@ This search is to identifies a modification in registry to disable the windows d
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **powershell_disable_security_monitoring_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md b/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md
index cf52d7e01a..8c1957878b 100644
--- a/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md
+++ b/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md
@@ -108,8 +108,8 @@ This search is to detect a suspicious loaded unsigned dll by MMC.exe application
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 Note that **uac_bypass_mmc_load_unsigned_dll_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-07-19-aws_createloginprofile.md b/docs/_posts/2021-07-19-aws_createloginprofile.md
index d00adf12c1..f800e58822 100644
--- a/docs/_posts/2021-07-19-aws_createloginprofile.md
+++ b/docs/_posts/2021-07-19-aws_createloginprofile.md
@@ -116,8 +116,8 @@ This search looks for AWS CloudTrail events where a user A(victim A) creates a l
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that **aws_createloginprofile_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-07-19-detect_new_open_s3_buckets.md b/docs/_posts/2021-07-19-detect_new_open_s3_buckets.md
index a31e892d5a..364ee513a4 100644
--- a/docs/_posts/2021-07-19-detect_new_open_s3_buckets.md
+++ b/docs/_posts/2021-07-19-detect_new_open_s3_buckets.md
@@ -115,8 +115,8 @@ This search looks for AWS CloudTrail events where a user has created an open/pub
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that **detect_new_open_s3_buckets_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-07-19-detect_new_open_s3_buckets_over_aws_cli.md b/docs/_posts/2021-07-19-detect_new_open_s3_buckets_over_aws_cli.md
index 4ae443a594..a3c79a5700 100644
--- a/docs/_posts/2021-07-19-detect_new_open_s3_buckets_over_aws_cli.md
+++ b/docs/_posts/2021-07-19-detect_new_open_s3_buckets_over_aws_cli.md
@@ -108,8 +108,8 @@ This search looks for AWS CloudTrail events where a user has created an open/pub
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that **detect_new_open_s3_buckets_over_aws_cli_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md b/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md
index fca4b372fa..581cbea2dc 100644
--- a/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md
+++ b/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md
@@ -107,10 +107,10 @@ This search is to detect a suspicious mshta.exe process that spawn rundll32 or r
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml)
+* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **mshta_spawning_rundll32_or_regsvr32_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md b/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md
index 54b0252299..6e63fe163e 100644
--- a/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md
+++ b/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md
@@ -107,8 +107,8 @@ this search is to detect a suspicious office product process that spawn cmd chil
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **office_product_spawn_cmd_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md b/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md
index c56733a83c..9fbc6d0603 100644
--- a/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md
+++ b/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md
@@ -102,8 +102,8 @@ This analytic identifies the suspicious Remote Thread execution of rundll32.exe
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 Note that **rundll32_createremotethread_in_browser_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md b/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md
index dc22f72471..f3edc8694b 100644
--- a/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md
+++ b/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md
@@ -106,8 +106,8 @@ This search is to detect a suspicious rundll32 process that drops executable (.e
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 Note that **rundll32_process_creating_exe_dll_files_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md b/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md
index 181a2c101c..8a062b9a7c 100644
--- a/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md
+++ b/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md
@@ -107,8 +107,8 @@ This search is to detect a suspicious rundll32.exe commandline to execute dll fi
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **suspicious_icedid_rundll32_cmdline_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md b/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md
index 3baf747b5d..c6aeb7557b 100644
--- a/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md
+++ b/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md
@@ -107,8 +107,8 @@ This search is to detect a suspicious rundll32.exe process with plugininit param
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **suspicious_rundll32_plugininit_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md b/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md
index 2143f4cde2..f54d937964 100644
--- a/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md
+++ b/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md
@@ -110,8 +110,8 @@ The following analytic identifies Regsvr32.exe utilizing the silent switch to lo
 #### Macros
 The SPL above uses the following Macros:
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **regsvr32_with_known_silent_switch_cmdline_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md b/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md
index 537bb14e8d..e3d3f392d6 100644
--- a/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md
+++ b/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md
@@ -102,8 +102,8 @@ This analytic identifies the suspicious Remote Thread execution of rundll32.exe
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 Note that **rundll32_create_remote_thread_to_a_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-07-30-drop_icedid_license_dat.md b/docs/_posts/2021-07-30-drop_icedid_license_dat.md
index dab7ce0922..1642ea8715 100644
--- a/docs/_posts/2021-07-30-drop_icedid_license_dat.md
+++ b/docs/_posts/2021-07-30-drop_icedid_license_dat.md
@@ -106,8 +106,8 @@ This search is to detect dropping a suspicious file named as "license.dat" in %a
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 Note that **drop_icedid_license_dat_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md b/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md
index 74c84eaf29..6edf12b83c 100644
--- a/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md
+++ b/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md
@@ -106,8 +106,8 @@ This search is to detect a suspicious file creation namely passff.tar and cookie
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 Note that **icedid_exfiltrated_archived_file_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md b/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md
index 39d676b24b..61c950a9cc 100644
--- a/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md
+++ b/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md
@@ -108,8 +108,8 @@ this detection was designed to identifies suspicious spawned process of known MS
 #### Macros
 The SPL above uses the following Macros:
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **office_application_spawn_regsvr32_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md b/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md
index 8af853fd04..3d6d7f91e5 100644
--- a/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md
+++ b/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md
@@ -101,8 +101,8 @@ This search is to detect a suspicious file creation of sqlite3.dll in %temp% fol
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 Note that **sqlite_module_in_temp_folder_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md b/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md
index 0b9dd66eb8..63c7d6be6e 100644
--- a/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md
+++ b/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md
@@ -102,8 +102,8 @@ This search is to detect suspicious process injection in command shell. This tec
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 Note that **create_remote_thread_in_shell_application_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md b/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md
index 6b4f16d95a..0de21d0535 100644
--- a/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md
+++ b/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md
@@ -106,8 +106,8 @@ This search is to detect a possible uac bypass using the colorui.dll COM Object.
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 Note that **uac_bypass_with_colorui_com_object_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-08-16-gsuite_drive_share_in_external_email.md b/docs/_posts/2021-08-16-gsuite_drive_share_in_external_email.md
index 13226cb1c5..f718a90ab5 100644
--- a/docs/_posts/2021-08-16-gsuite_drive_share_in_external_email.md
+++ b/docs/_posts/2021-08-16-gsuite_drive_share_in_external_email.md
@@ -111,8 +111,8 @@ This search is to detect suspicious google drive or google docs files shared out
 
 #### Macros
 The SPL above uses the following Macros:
-* [gsuite_drive](https://github.com/splunk/security_content/blob/develop/macros/gsuite_drive.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [gsuite_drive](https://github.com/splunk/security_content/blob/develop/macros/gsuite_drive.yml)
 
 Note that **gsuite_drive_share_in_external_email_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_high.md b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_high.md
index 053ef6340c..2ee0d5fd8a 100644
--- a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_high.md
+++ b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_high.md
@@ -119,8 +119,8 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service (
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that **aws_ecr_container_scanning_findings_high_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_low_informational_unknown.md b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_low_informational_unknown.md
index 70c74390d1..0778c43a9f 100644
--- a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_low_informational_unknown.md
+++ b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_low_informational_unknown.md
@@ -119,8 +119,8 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service (
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that **aws_ecr_container_scanning_findings_low_informational_unknown_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_medium.md b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_medium.md
index 847ba4d0b9..58d17ed3e6 100644
--- a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_medium.md
+++ b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_medium.md
@@ -119,8 +119,8 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service (
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that **aws_ecr_container_scanning_findings_medium_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-08-19-aws_ecr_container_upload_outside_business_hours.md b/docs/_posts/2021-08-19-aws_ecr_container_upload_outside_business_hours.md
index 2e87df2551..7707095da2 100644
--- a/docs/_posts/2021-08-19-aws_ecr_container_upload_outside_business_hours.md
+++ b/docs/_posts/2021-08-19-aws_ecr_container_upload_outside_business_hours.md
@@ -115,8 +115,8 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service (
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that **aws_ecr_container_upload_outside_business_hours_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md b/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md
index 8bf711341c..21549c9cd7 100644
--- a/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md
+++ b/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md
@@ -115,8 +115,8 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service (
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [aws_ecr_users](https://github.com/splunk/security_content/blob/develop/macros/aws_ecr_users.yml)
 
 Note that **aws_ecr_container_upload_unknown_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-20-github_commit_changes_in_master.md b/docs/_posts/2021-08-20-github_commit_changes_in_master.md
index 64f3e2058b..8cb069125a 100644
--- a/docs/_posts/2021-08-20-github_commit_changes_in_master.md
+++ b/docs/_posts/2021-08-20-github_commit_changes_in_master.md
@@ -92,10 +92,8 @@ This search is to detect a pushed or commit to master or main branch. This is to
 
 ```
 `github` branches{}.name = main OR branches{}.name = master 
-| eval severity="low" 
-| eval phase="code" 
-|  stats count min(_time) as firstTime max(_time) as lastTime  by commit.author.html_url commit.commit.author.email commit.author.login commit.commit.message repository.pushed_at commit.commit.committer.date, phase, severity 
-| eval phase="code" 
+|  stats count min(_time) as firstTime max(_time) as lastTime by commit.commit.author.email commit.author.login commit.commit.message repository.pushed_at commit.commit.committer.date repository.full_name 
+| rename commit.author.login as user, repository.full_name as repository 
 | `security_content_ctime(firstTime)` 
 | `security_content_ctime(lastTime)` 
 | `github_commit_changes_in_master_filter`
@@ -103,8 +101,8 @@ This search is to detect a pushed or commit to master or main branch. This is to
 
 #### Macros
 The SPL above uses the following Macros:
-* [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml)
 
 Note that **github_commit_changes_in_master_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-08-23-gsuite_suspicious_shared_file_name.md b/docs/_posts/2021-08-23-gsuite_suspicious_shared_file_name.md
index 0f485dcb01..8cae71b6f8 100644
--- a/docs/_posts/2021-08-23-gsuite_suspicious_shared_file_name.md
+++ b/docs/_posts/2021-08-23-gsuite_suspicious_shared_file_name.md
@@ -111,8 +111,8 @@ This search is to detect a shared file in google drive with suspicious file name
 
 #### Macros
 The SPL above uses the following Macros:
-* [gsuite_drive](https://github.com/splunk/security_content/blob/develop/macros/gsuite_drive.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [gsuite_drive](https://github.com/splunk/security_content/blob/develop/macros/gsuite_drive.yml)
 
 Note that **gsuite_suspicious_shared_file_name_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-08-24-get-domaintrust_with_powershell.md b/docs/_posts/2021-08-24-get-domaintrust_with_powershell.md
index 172fefda09..e00b0be711 100644
--- a/docs/_posts/2021-08-24-get-domaintrust_with_powershell.md
+++ b/docs/_posts/2021-08-24-get-domaintrust_with_powershell.md
@@ -156,4 +156,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/get-domaintrust_with_powershell.yml) \| *version*: **1**
\ No newline at end of file
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/get_domaintrust_with_powershell.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2021-08-24-get-domaintrust_with_powershell_script_block.md b/docs/_posts/2021-08-24-get-domaintrust_with_powershell_script_block.md
index 6c565d2699..2517fc3fd2 100644
--- a/docs/_posts/2021-08-24-get-domaintrust_with_powershell_script_block.md
+++ b/docs/_posts/2021-08-24-get-domaintrust_with_powershell_script_block.md
@@ -155,4 +155,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/get-domaintrust_with_powershell_script_block.yml) \| *version*: **1**
\ No newline at end of file
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2021-08-24-kubernetes_scanner_image_pulling.md b/docs/_posts/2021-08-24-kubernetes_scanner_image_pulling.md
index 3fdbeb4524..9dd84e7f6a 100644
--- a/docs/_posts/2021-08-24-kubernetes_scanner_image_pulling.md
+++ b/docs/_posts/2021-08-24-kubernetes_scanner_image_pulling.md
@@ -111,8 +111,8 @@ This search uses the Kubernetes logs from Splunk Connect from Kubernetes to dete
 
 #### Macros
 The SPL above uses the following Macros:
-* [kube_objects_events](https://github.com/splunk/security_content/blob/develop/macros/kube_objects_events.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [kube_objects_events](https://github.com/splunk/security_content/blob/develop/macros/kube_objects_events.yml)
 
 Note that **kubernetes_scanner_image_pulling_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md b/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md
index 26b2b7d18c..4901512136 100644
--- a/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md
+++ b/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md
@@ -107,8 +107,8 @@ Review the source attempting to perform this activity against your environment.
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [exchange](https://github.com/splunk/security_content/blob/develop/macros/exchange.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that **exchange_powershell_abuse_via_ssrf_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-01-github_commit_in_develop.md b/docs/_posts/2021-09-01-github_commit_in_develop.md
index 295fa24353..25c3927186 100644
--- a/docs/_posts/2021-09-01-github_commit_in_develop.md
+++ b/docs/_posts/2021-09-01-github_commit_in_develop.md
@@ -101,8 +101,8 @@ This search is to detect a pushed or commit to develop branch. This is to avoid
 
 #### Macros
 The SPL above uses the following Macros:
-* [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml)
 
 Note that **github_commit_in_develop_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-01-github_dependabot_alert.md b/docs/_posts/2021-09-01-github_dependabot_alert.md
index bb9da9f88c..9498c4e6a2 100644
--- a/docs/_posts/2021-09-01-github_dependabot_alert.md
+++ b/docs/_posts/2021-09-01-github_dependabot_alert.md
@@ -113,8 +113,8 @@ This search looks for Dependabot Alerts in Github logs.
 
 #### Macros
 The SPL above uses the following Macros:
-* [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml)
 
 Note that **github_dependabot_alert_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md b/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md
index 7df2bb684c..3d1baf9a67 100644
--- a/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md
+++ b/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md
@@ -114,9 +114,9 @@ This search looks for Pull Request from unknown user.
 
 #### Macros
 The SPL above uses the following Macros:
-* [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml)
-* [github_known_users](https://github.com/splunk/security_content/blob/develop/macros/github_known_users.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [github_known_users](https://github.com/splunk/security_content/blob/develop/macros/github_known_users.yml)
+* [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml)
 
 Note that **github_pull_request_from_unknown_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-02-get-foresttrust_with_powershell.md b/docs/_posts/2021-09-02-get-foresttrust_with_powershell.md
index 7543d491f5..eca0a8b31f 100644
--- a/docs/_posts/2021-09-02-get-foresttrust_with_powershell.md
+++ b/docs/_posts/2021-09-02-get-foresttrust_with_powershell.md
@@ -156,4 +156,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/get-foresttrust_with_powershell.yml) \| *version*: **1**
\ No newline at end of file
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/get_foresttrust_with_powershell.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2021-09-02-get-foresttrust_with_powershell_script_block.md b/docs/_posts/2021-09-02-get-foresttrust_with_powershell_script_block.md
index 54a0879385..f02f0cf197 100644
--- a/docs/_posts/2021-09-02-get-foresttrust_with_powershell_script_block.md
+++ b/docs/_posts/2021-09-02-get-foresttrust_with_powershell_script_block.md
@@ -151,4 +151,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/get-foresttrust_with_powershell_script_block.yml) \| *version*: **1**
\ No newline at end of file
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md b/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md
index b0576cbb0c..5679158b61 100644
--- a/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md
+++ b/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md
@@ -106,8 +106,8 @@ This analytic is to detect an application try to connect and create ADSI Object
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 Note that **schcache_change_by_app_connect_and_create_adsi_object_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md b/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md
index e7938a916a..01131f25c4 100644
--- a/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md
+++ b/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md
@@ -112,8 +112,8 @@ The following hunting detection identifies rundll32.exe with `control_rundll` wi
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **rundll32_control_rundll_hunt_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md b/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md
index e26bd4d1ae..82b16635a2 100644
--- a/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md
+++ b/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md
@@ -112,8 +112,8 @@ The following detection identifies rundll32.exe with `control_rundll` within the
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **rundll32_control_rundll_world_writable_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-09-extraction_of_registry_hives.md b/docs/_posts/2021-09-09-extraction_of_registry_hives.md
index 315ab75f6d..3e97237b15 100644
--- a/docs/_posts/2021-09-09-extraction_of_registry_hives.md
+++ b/docs/_posts/2021-09-09-extraction_of_registry_hives.md
@@ -107,8 +107,8 @@ The following analytic identifies the use of `reg.exe` exporting Windows Registr
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_reg](https://github.com/splunk/security_content/blob/develop/macros/process_reg.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_reg](https://github.com/splunk/security_content/blob/develop/macros/process_reg.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **extraction_of_registry_hives_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-09-mshtml_module_load_in_office_product.md b/docs/_posts/2021-09-09-mshtml_module_load_in_office_product.md
index 6fe995e38e..e9d852091f 100644
--- a/docs/_posts/2021-09-09-mshtml_module_load_in_office_product.md
+++ b/docs/_posts/2021-09-09-mshtml_module_load_in_office_product.md
@@ -112,8 +112,8 @@ The following detection identifies the module load of mshtml.dll into an Office
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 Note that **mshtml_module_load_in_office_product_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md b/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md
index d466c29b33..48a0b4de9a 100644
--- a/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md
+++ b/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md
@@ -106,8 +106,8 @@ This search is to detect a suspicious MS scripting process such as wscript.exe o
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 Note that **ms_scripting_process_loading_ldap_module_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md b/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md
index 25a5d34c04..b9c551bed9 100644
--- a/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md
+++ b/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md
@@ -106,8 +106,8 @@ This search is to detect a suspicious MS scripting process such as wscript.exe o
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 Note that **ms_scripting_process_loading_wmi_module_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md b/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md
index 84c03e842b..cc1e2c0bee 100644
--- a/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md
+++ b/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md
@@ -116,8 +116,8 @@ Attempt To Add Certificate To Untrusted Store
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **attempt_to_add_certificate_to_untrusted_store_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md b/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md
index 99c2b43b5e..6a1b458aa7 100644
--- a/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md
+++ b/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md
@@ -113,9 +113,9 @@ Monitor for execution of reg.exe with parameters specifying an export of keys th
 
 #### Macros
 The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
 * [process_reg](https://github.com/splunk/security_content/blob/develop/macros/process_reg.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **attempted_credential_dump_from_registry_via_reg_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-16-bits_job_persistence.md b/docs/_posts/2021-09-16-bits_job_persistence.md
index ef2e67a029..ff6bbe786b 100644
--- a/docs/_posts/2021-09-16-bits_job_persistence.md
+++ b/docs/_posts/2021-09-16-bits_job_persistence.md
@@ -103,8 +103,8 @@ The following query identifies Microsoft Background Intelligent Transfer Service
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_bitsadmin](https://github.com/splunk/security_content/blob/develop/macros/process_bitsadmin.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_bitsadmin](https://github.com/splunk/security_content/blob/develop/macros/process_bitsadmin.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **bits_job_persistence_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-16-bitsadmin_download_file.md b/docs/_posts/2021-09-16-bitsadmin_download_file.md
index 2e6f8a337c..ff54a4e63e 100644
--- a/docs/_posts/2021-09-16-bitsadmin_download_file.md
+++ b/docs/_posts/2021-09-16-bitsadmin_download_file.md
@@ -108,8 +108,8 @@ The following query identifies Microsoft Background Intelligent Transfer Service
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_bitsadmin](https://github.com/splunk/security_content/blob/develop/macros/process_bitsadmin.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_bitsadmin](https://github.com/splunk/security_content/blob/develop/macros/process_bitsadmin.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **bitsadmin_download_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md b/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md
index 4033f482e2..a771cad203 100644
--- a/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md
+++ b/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md
@@ -112,9 +112,9 @@ This search detects the use of wmic and Powershell to create a shadow copy.
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
-* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml)
+* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **creation_of_shadow_copy_with_wmic_and_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md b/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md
index 5f43359cf3..ade274efcc 100644
--- a/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md
+++ b/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md
@@ -112,8 +112,8 @@ This search detects credential dumping using copy command from a shadow copy.
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **credential_dumping_via_copy_command_from_shadow_copy_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md b/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md
index b5dc37517c..fd399b6fad 100644
--- a/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md
+++ b/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md
@@ -112,8 +112,8 @@ This search detects the creation of a symlink to a shadow copy.
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **credential_dumping_via_symlink_to_shadow_copy_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md b/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md
index ea3718651a..47536feef9 100644
--- a/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md
+++ b/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md
@@ -112,8 +112,8 @@ This search looks for events where `PsExec.exe` is run with the `accepteula` fla
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_psexec](https://github.com/splunk/security_content/blob/develop/macros/process_psexec.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_psexec](https://github.com/splunk/security_content/blob/develop/macros/process_psexec.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **detect_psexec_with_accepteula_flag_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-16-detect_renamed_7-zip.md b/docs/_posts/2021-09-16-detect_renamed_7-zip.md
index fdb88b2d85..dd228c651e 100644
--- a/docs/_posts/2021-09-16-detect_renamed_7-zip.md
+++ b/docs/_posts/2021-09-16-detect_renamed_7-zip.md
@@ -161,4 +161,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/detect_renamed_7-zip.yml) \| *version*: **2**
\ No newline at end of file
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/detect_renamed_7_zip.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2021-09-16-detect_renamed_psexec.md b/docs/_posts/2021-09-16-detect_renamed_psexec.md
index 90978b364e..8ce0ca28c4 100644
--- a/docs/_posts/2021-09-16-detect_renamed_psexec.md
+++ b/docs/_posts/2021-09-16-detect_renamed_psexec.md
@@ -107,8 +107,8 @@ The following analytic identifies renamed instances of `PsExec.exe` being utiliz
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_psexec](https://github.com/splunk/security_content/blob/develop/macros/process_psexec.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_psexec](https://github.com/splunk/security_content/blob/develop/macros/process_psexec.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **detect_renamed_psexec_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-16-dump_lsass_via_procdump.md b/docs/_posts/2021-09-16-dump_lsass_via_procdump.md
index a012cd382a..35fd14421e 100644
--- a/docs/_posts/2021-09-16-dump_lsass_via_procdump.md
+++ b/docs/_posts/2021-09-16-dump_lsass_via_procdump.md
@@ -114,8 +114,8 @@ During triage, confirm this is procdump.exe executing. If it is the first time a
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_procdump](https://github.com/splunk/security_content/blob/develop/macros/process_procdump.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_procdump](https://github.com/splunk/security_content/blob/develop/macros/process_procdump.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **dump_lsass_via_procdump_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-16-processes_launching_netsh.md b/docs/_posts/2021-09-16-processes_launching_netsh.md
index c00900d76e..bb7d2887fb 100644
--- a/docs/_posts/2021-09-16-processes_launching_netsh.md
+++ b/docs/_posts/2021-09-16-processes_launching_netsh.md
@@ -113,8 +113,8 @@ This search looks for processes launching netsh.exe. Netsh is a command-line scr
 #### Macros
 The SPL above uses the following Macros:
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **processes_launching_netsh_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-29-verclsid_clsid_execution.md b/docs/_posts/2021-09-29-verclsid_clsid_execution.md
index 90ebfbe0e2..aeca9d6439 100644
--- a/docs/_posts/2021-09-29-verclsid_clsid_execution.md
+++ b/docs/_posts/2021-09-29-verclsid_clsid_execution.md
@@ -107,9 +107,9 @@ This analytic is to detect a possible abuse of verclsid to execute malicious fil
 
 #### Macros
 The SPL above uses the following Macros:
+* [process_verclsid](https://github.com/splunk/security_content/blob/develop/macros/process_verclsid.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [process_verclsid](https://github.com/splunk/security_content/blob/develop/macros/process_verclsid.yml)
 
 Note that **verclsid_clsid_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md b/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md
index c16b1032d2..b3561698f6 100644
--- a/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md
+++ b/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md
@@ -110,8 +110,8 @@ This analytic is to detect a loading of dll using regsvr32 application with sile
 #### Macros
 The SPL above uses the following Macros:
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **regsvr32_silent_and_install_param_dll_loading_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-10-05-rundll32_shimcache_flush.md b/docs/_posts/2021-10-05-rundll32_shimcache_flush.md
index 05f51886a0..08f8dd4272 100644
--- a/docs/_posts/2021-10-05-rundll32_shimcache_flush.md
+++ b/docs/_posts/2021-10-05-rundll32_shimcache_flush.md
@@ -102,8 +102,8 @@ This analytic is to detect a suspicious rundll32 commandline to clear shim cache
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **rundll32_shimcache_flush_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-12-aws_iam_accessdenied_discovery_events.md b/docs/_posts/2021-11-12-aws_iam_accessdenied_discovery_events.md
index 601af0aab9..14aa94136a 100644
--- a/docs/_posts/2021-11-12-aws_iam_accessdenied_discovery_events.md
+++ b/docs/_posts/2021-11-12-aws_iam_accessdenied_discovery_events.md
@@ -102,8 +102,8 @@ The following detection identifies excessive AccessDenied events within an hour
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that **aws_iam_accessdenied_discovery_events_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md b/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md
index 85dbb9e458..2a31021be0 100644
--- a/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md
+++ b/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md
@@ -107,8 +107,8 @@ this analytic is to detect a suspicious compile before delivery approach of .net
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_csc](https://github.com/splunk/security_content/blob/develop/macros/process_csc.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_csc](https://github.com/splunk/security_content/blob/develop/macros/process_csc.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **csc_net_on_the_fly_compilation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md b/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md
index a929569f28..d1e7f3fc96 100644
--- a/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md
+++ b/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md
@@ -107,8 +107,8 @@ This analytic look for a spawned process of route.exe windows application. Adver
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_route](https://github.com/splunk/security_content/blob/develop/macros/process_route.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_route](https://github.com/splunk/security_content/blob/develop/macros/process_route.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **network_discovery_using_route_windows_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-12-runas_execution_in_commandline.md b/docs/_posts/2021-11-12-runas_execution_in_commandline.md
index 9f6f425932..a01368e877 100644
--- a/docs/_posts/2021-11-12-runas_execution_in_commandline.md
+++ b/docs/_posts/2021-11-12-runas_execution_in_commandline.md
@@ -109,8 +109,8 @@ This analytic look for a spawned runas.exe process with a administrator user opt
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_runas](https://github.com/splunk/security_content/blob/develop/macros/process_runas.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_runas](https://github.com/splunk/security_content/blob/develop/macros/process_runas.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **runas_execution_in_commandline_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-12-windows_installutil_credential_theft.md b/docs/_posts/2021-11-12-windows_installutil_credential_theft.md
index 4d11b99aa7..4dcc0262e3 100644
--- a/docs/_posts/2021-11-12-windows_installutil_credential_theft.md
+++ b/docs/_posts/2021-11-12-windows_installutil_credential_theft.md
@@ -110,8 +110,8 @@ During triage review resulting network connections, file modifications, and para
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 Note that **windows_installutil_credential_theft_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md b/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md
index 703e35936e..e468ce76ab 100644
--- a/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md
+++ b/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md
@@ -112,8 +112,8 @@ During triage review resulting network connections, file modifications, and para
 #### Macros
 The SPL above uses the following Macros:
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **windows_installutil_uninstall_option_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md b/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md
index c3cad50e0a..c23a955228 100644
--- a/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md
+++ b/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md
@@ -111,8 +111,8 @@ During triage review resulting network connections, file modifications, and para
 #### Macros
 The SPL above uses the following Macros:
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **windows_installutil_url_in_command_line_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell.md b/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell.md
index 4d642713fd..ed2ee33339 100644
--- a/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell.md
+++ b/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell.md
@@ -107,8 +107,8 @@ This analytic looks for the execution of `powershell.exe` with arguments utilize
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **remote_process_instantiation_via_dcom_and_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell.md b/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell.md
index 785cef016a..93be6d25d3 100644
--- a/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell.md
+++ b/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell.md
@@ -102,8 +102,8 @@ This analytic looks for the execution of `powershell.exe` leveraging the `Invoke
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **remote_process_instantiation_via_wmi_and_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell.md b/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell.md
index cc6c13908a..06f1fecad3 100644
--- a/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell.md
+++ b/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell.md
@@ -107,8 +107,8 @@ This analytic looks for the execution of `powershell.exe` with arguments utilize
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **remote_process_instantiation_via_winrm_and_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md b/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md
index c80c3e0ed1..5dd955aa03 100644
--- a/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md
+++ b/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md
@@ -108,8 +108,8 @@ DynamicWrapperX is an ActiveX component that can be used in a script to call Win
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 Note that **loading_of_dynwrapx_module_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-11-22-windows_service_created_with_suspicious_service_path.md b/docs/_posts/2021-11-22-windows_service_created_with_suspicious_service_path.md
index dc60511f07..3b338d2744 100644
--- a/docs/_posts/2021-11-22-windows_service_created_with_suspicious_service_path.md
+++ b/docs/_posts/2021-11-22-windows_service_created_with_suspicious_service_path.md
@@ -105,8 +105,8 @@ The following analytc uses Windows Event Id 7045, `New Service Was Installed`, t
 
 #### Macros
 The SPL above uses the following Macros:
-* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml)
 
 Note that **windows_service_created_with_suspicious_service_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-11-22-windows_service_created_within_public_path.md b/docs/_posts/2021-11-22-windows_service_created_within_public_path.md
index 022efd6778..b9d4f933a3 100644
--- a/docs/_posts/2021-11-22-windows_service_created_within_public_path.md
+++ b/docs/_posts/2021-11-22-windows_service_created_within_public_path.md
@@ -107,8 +107,8 @@ The following analytc uses Windows Event Id 7045, `New Service Was Installed`, t
 
 #### Macros
 The SPL above uses the following Macros:
-* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml)
 
 Note that **windows_service_created_within_public_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-11-29-detect_rclone_command-line_usage.md b/docs/_posts/2021-11-29-detect_rclone_command-line_usage.md
index 1f0713fa35..396257541b 100644
--- a/docs/_posts/2021-11-29-detect_rclone_command-line_usage.md
+++ b/docs/_posts/2021-11-29-detect_rclone_command-line_usage.md
@@ -102,8 +102,8 @@ This analytic identifies commonly used command-line arguments used by `rclone.ex
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_rclone](https://github.com/splunk/security_content/blob/develop/macros/process_rclone.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_rclone](https://github.com/splunk/security_content/blob/develop/macros/process_rclone.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **detect_rclone_command-line_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -158,4 +158,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/detect_rclone_command-line_usage.yml) \| *version*: **2**
\ No newline at end of file
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/detect_rclone_command_line_usage.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2021-12-08-msi_module_loaded_by_non-system_binary.md b/docs/_posts/2021-12-08-msi_module_loaded_by_non-system_binary.md
index dfc9568416..05962d1d59 100644
--- a/docs/_posts/2021-12-08-msi_module_loaded_by_non-system_binary.md
+++ b/docs/_posts/2021-12-08-msi_module_loaded_by_non-system_binary.md
@@ -119,8 +119,8 @@ In addition, `msi.dll` has been abused in DLL side-loading attacks by being load
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 Note that **msi_module_loaded_by_non-system_binary_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
@@ -167,4 +167,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/msi_module_loaded_by_non-system_binary.yml) \| *version*: **1**
\ No newline at end of file
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/msi_module_loaded_by_non_system_binary.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2021-12-13-linux_java_spawning_shell.md b/docs/_posts/2021-12-13-linux_java_spawning_shell.md
index 8a7949ad8f..1c6e1e731a 100644
--- a/docs/_posts/2021-12-13-linux_java_spawning_shell.md
+++ b/docs/_posts/2021-12-13-linux_java_spawning_shell.md
@@ -107,8 +107,8 @@ The following analytic identifies the process name of Java, Apache, or Tomcat sp
 
 #### Macros
 The SPL above uses the following Macros:
-* [linux_shells](https://github.com/splunk/security_content/blob/develop/macros/linux_shells.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [linux_shells](https://github.com/splunk/security_content/blob/develop/macros/linux_shells.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **linux_java_spawning_shell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-01-12-powershell_-_connect_to_internet_with_hidden_window.md b/docs/_posts/2022-01-12-powershell_-_connect_to_internet_with_hidden_window.md
index 33278a40da..a9cf81a00d 100644
--- a/docs/_posts/2022-01-12-powershell_-_connect_to_internet_with_hidden_window.md
+++ b/docs/_posts/2022-01-12-powershell_-_connect_to_internet_with_hidden_window.md
@@ -126,8 +126,8 @@ The following hunting analytic identifies PowerShell commands utilizing the Wind
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **powershell_-_connect_to_internet_with_hidden_window_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -182,4 +182,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/powershell_-_connect_to_internet_with_hidden_window.yml) \| *version*: **8**
\ No newline at end of file
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml) \| *version*: **8**
\ No newline at end of file
diff --git a/docs/_posts/2022-01-12-windows_hunting_system_account_targeting_lsass.md b/docs/_posts/2022-01-12-windows_hunting_system_account_targeting_lsass.md
index cd569b7713..de5dd6c1d4 100644
--- a/docs/_posts/2022-01-12-windows_hunting_system_account_targeting_lsass.md
+++ b/docs/_posts/2022-01-12-windows_hunting_system_account_targeting_lsass.md
@@ -109,8 +109,8 @@ The following hunting analytic identifies all processes requesting access into L
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 Note that **windows_hunting_system_account_targeting_lsass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-01-12-windows_non-system_account_targeting_lsass.md b/docs/_posts/2022-01-12-windows_non-system_account_targeting_lsass.md
index 60c7093de5..1aaff1ac13 100644
--- a/docs/_posts/2022-01-12-windows_non-system_account_targeting_lsass.md
+++ b/docs/_posts/2022-01-12-windows_non-system_account_targeting_lsass.md
@@ -109,8 +109,8 @@ The following analytic identifies non SYSTEM accounts requesting access to lsass
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 Note that **windows_non-system_account_targeting_lsass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
@@ -163,4 +163,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_non-system_account_targeting_lsass.yml) \| *version*: **1**
\ No newline at end of file
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_non_system_account_targeting_lsass.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-01-14-potentially_malicious_code_on_commandline.md b/docs/_posts/2022-01-14-potentially_malicious_code_on_commandline.md
index 70a9136394..7666adf8e2 100644
--- a/docs/_posts/2022-01-14-potentially_malicious_code_on_commandline.md
+++ b/docs/_posts/2022-01-14-potentially_malicious_code_on_commandline.md
@@ -108,8 +108,8 @@ The following analytic uses a pretrained machine learning text classifier to det
 
 #### Macros
 The SPL above uses the following Macros:
-* [potentially_malicious_code_on_cmdline_tokenize_score](https://github.com/splunk/security_content/blob/develop/macros/potentially_malicious_code_on_cmdline_tokenize_score.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [potentially_malicious_code_on_cmdline_tokenize_score](https://github.com/splunk/security_content/blob/develop/macros/potentially_malicious_code_on_cmdline_tokenize_score.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **potentially_malicious_code_on_commandline_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md b/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md
index 3975681f7b..c88d8bcf6c 100644
--- a/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md
+++ b/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md
@@ -112,8 +112,8 @@ The following analytic identifies command-line arguments where `cmd.exe /c` is u
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **cmd_carry_out_string_command_parameter_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-01-18-malicious_powershell_process_-_encoded_command.md b/docs/_posts/2022-01-18-malicious_powershell_process_-_encoded_command.md
index 04ef13331b..505e535bb8 100644
--- a/docs/_posts/2022-01-18-malicious_powershell_process_-_encoded_command.md
+++ b/docs/_posts/2022-01-18-malicious_powershell_process_-_encoded_command.md
@@ -119,8 +119,8 @@ Alternatively, may use regex per matching here https://regexr.com/662ov.
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **malicious_powershell_process_-_encoded_command_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -175,4 +175,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/malicious_powershell_process_-_encoded_command.yml) \| *version*: **7**
\ No newline at end of file
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/malicious_powershell_process___encoded_command.yml) \| *version*: **7**
\ No newline at end of file
diff --git a/docs/_posts/2022-01-18-suspicious_process_dns_query_known_abuse_web_services.md b/docs/_posts/2022-01-18-suspicious_process_dns_query_known_abuse_web_services.md
index 20ea3aa0e0..625116b089 100644
--- a/docs/_posts/2022-01-18-suspicious_process_dns_query_known_abuse_web_services.md
+++ b/docs/_posts/2022-01-18-suspicious_process_dns_query_known_abuse_web_services.md
@@ -106,8 +106,8 @@ This analytic detects a suspicious process making a DNS query via known, abused
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 Note that **suspicious_process_dns_query_known_abuse_web_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-01-19-suspicious_process_with_discord_dns_query.md b/docs/_posts/2022-01-19-suspicious_process_with_discord_dns_query.md
index c102f70073..790b96d787 100644
--- a/docs/_posts/2022-01-19-suspicious_process_with_discord_dns_query.md
+++ b/docs/_posts/2022-01-19-suspicious_process_with_discord_dns_query.md
@@ -112,8 +112,8 @@ This analytic identifies a process making a DNS query to Discord, a well known i
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 Note that **suspicious_process_with_discord_dns_query_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md b/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md
index 20288a14c6..b5ff40aaac 100644
--- a/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md
+++ b/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md
@@ -118,8 +118,8 @@ The following analytic identifies native .net binaries within the Windows operat
 
 #### Macros
 The SPL above uses the following Macros:
-* [is_net_windows_file](https://github.com/splunk/security_content/blob/develop/macros/is_net_windows_file.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [is_net_windows_file](https://github.com/splunk/security_content/blob/develop/macros/is_net_windows_file.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **windows_dotnet_binary_in_non_standard_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md b/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md
index 2151067a4b..75b9538dfa 100644
--- a/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md
+++ b/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md
@@ -118,8 +118,8 @@ The following analytic identifies the Windows binary InstallUtil.exe running fro
 #### Macros
 The SPL above uses the following Macros:
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **windows_installutil_in_non_standard_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-01-20-excessive_file_deletion_in_windefender_folder.md b/docs/_posts/2022-01-20-excessive_file_deletion_in_windefender_folder.md
index 19efd5ad59..8c544b007e 100644
--- a/docs/_posts/2022-01-20-excessive_file_deletion_in_windefender_folder.md
+++ b/docs/_posts/2022-01-20-excessive_file_deletion_in_windefender_folder.md
@@ -108,8 +108,8 @@ This analytic will identify excessive file deletion events in the Windows Defend
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 Note that **excessive_file_deletion_in_windefender_folder_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-01-20-ping_sleep_batch_command.md b/docs/_posts/2022-01-20-ping_sleep_batch_command.md
index d96b03ca2d..18e92b3fae 100644
--- a/docs/_posts/2022-01-20-ping_sleep_batch_command.md
+++ b/docs/_posts/2022-01-20-ping_sleep_batch_command.md
@@ -115,8 +115,8 @@ This analytic will identify the possible execution of ping sleep batch commands.
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [process_ping](https://github.com/splunk/security_content/blob/develop/macros/process_ping.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **ping_sleep_batch_command_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-01-24-windows_nirsoft_utilities.md b/docs/_posts/2022-01-24-windows_nirsoft_utilities.md
index 25f5abdba3..a46d3647bc 100644
--- a/docs/_posts/2022-01-24-windows_nirsoft_utilities.md
+++ b/docs/_posts/2022-01-24-windows_nirsoft_utilities.md
@@ -103,8 +103,8 @@ The following hunting analytic assists with identifying the proces execution of
 
 #### Macros
 The SPL above uses the following Macros:
-* [is_nirsoft_software](https://github.com/splunk/security_content/blob/develop/macros/is_nirsoft_software.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [is_nirsoft_software](https://github.com/splunk/security_content/blob/develop/macros/is_nirsoft_software.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **windows_nirsoft_utilities_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-01-26-log4shell_cve-2021-44228_exploitation.md b/docs/_posts/2022-01-26-log4shell_cve-2021-44228_exploitation.md
index 0d15d75183..2f00e615bb 100644
--- a/docs/_posts/2022-01-26-log4shell_cve-2021-44228_exploitation.md
+++ b/docs/_posts/2022-01-26-log4shell_cve-2021-44228_exploitation.md
@@ -170,4 +170,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/log4shell_cve-2021-44228_exploitation.yml) \| *version*: **1**
\ No newline at end of file
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/log4shell_cve_2021_44228_exploitation.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-01-27-windows_possible_credential_dumping.md b/docs/_posts/2022-01-27-windows_possible_credential_dumping.md
index f3f96dfe7f..4ec0f102de 100644
--- a/docs/_posts/2022-01-27-windows_possible_credential_dumping.md
+++ b/docs/_posts/2022-01-27-windows_possible_credential_dumping.md
@@ -113,8 +113,8 @@ The idea behind using ntdll.dll is to blend in by using native api of ntdll.dll.
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 Note that **windows_possible_credential_dumping_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-01-28-hide_user_account_from_sign-in_screen.md b/docs/_posts/2022-01-28-hide_user_account_from_sign-in_screen.md
index 87dd3c7067..8ac918d4e1 100644
--- a/docs/_posts/2022-01-28-hide_user_account_from_sign-in_screen.md
+++ b/docs/_posts/2022-01-28-hide_user_account_from_sign-in_screen.md
@@ -159,4 +159,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/hide_user_account_from_sign-in_screen.yml) \| *version*: **2**
\ No newline at end of file
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-02-01-suspicious_rundll32_rename.md b/docs/_posts/2022-02-01-suspicious_rundll32_rename.md
index 7d3a5639a2..007b87cfb1 100644
--- a/docs/_posts/2022-02-01-suspicious_rundll32_rename.md
+++ b/docs/_posts/2022-02-01-suspicious_rundll32_rename.md
@@ -122,8 +122,8 @@ The following hunting analytic identifies renamed instances of rundll32.exe exec
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **suspicious_rundll32_rename_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-02-03-certutil_download_with_urlcache_and_split_arguments.md b/docs/_posts/2022-02-03-certutil_download_with_urlcache_and_split_arguments.md
index fc5b160e81..d1cb322156 100644
--- a/docs/_posts/2022-02-03-certutil_download_with_urlcache_and_split_arguments.md
+++ b/docs/_posts/2022-02-03-certutil_download_with_urlcache_and_split_arguments.md
@@ -102,8 +102,8 @@ Certutil.exe may download a file from a remote destination using `-urlcache`. Th
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **certutil_download_with_urlcache_and_split_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-02-03-certutil_download_with_verifyctl_and_split_arguments.md b/docs/_posts/2022-02-03-certutil_download_with_verifyctl_and_split_arguments.md
index b2790ea217..89e246923f 100644
--- a/docs/_posts/2022-02-03-certutil_download_with_verifyctl_and_split_arguments.md
+++ b/docs/_posts/2022-02-03-certutil_download_with_verifyctl_and_split_arguments.md
@@ -102,8 +102,8 @@ Certutil.exe may download a file from a remote destination using `-VerifyCtl`. T
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **certutil_download_with_verifyctl_and_split_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-02-07-rubeus_kerberos_ticket_exports_through_winlogon_access.md b/docs/_posts/2022-02-07-rubeus_kerberos_ticket_exports_through_winlogon_access.md
index db38882aa7..b3a2bd7c5d 100644
--- a/docs/_posts/2022-02-07-rubeus_kerberos_ticket_exports_through_winlogon_access.md
+++ b/docs/_posts/2022-02-07-rubeus_kerberos_ticket_exports_through_winlogon_access.md
@@ -108,8 +108,8 @@ The following analytic looks for a process accessing the winlogon.exe system pro
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 Note that **rubeus_kerberos_ticket_exports_through_winlogon_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-02-07-windows_schtasks_create_run_as_system.md b/docs/_posts/2022-02-07-windows_schtasks_create_run_as_system.md
index e1dd2d287a..d8e870c17a 100644
--- a/docs/_posts/2022-02-07-windows_schtasks_create_run_as_system.md
+++ b/docs/_posts/2022-02-07-windows_schtasks_create_run_as_system.md
@@ -112,8 +112,8 @@ The following analytic identifies Schtasks.exe creating a new task to start and
 #### Macros
 The SPL above uses the following Macros:
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_schtasks](https://github.com/splunk/security_content/blob/develop/macros/process_schtasks.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **windows_schtasks_create_run_as_system_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-02-08-rundll_loading_dll_by_ordinal.md b/docs/_posts/2022-02-08-rundll_loading_dll_by_ordinal.md
index 66a219e534..10b5ccf990 100644
--- a/docs/_posts/2022-02-08-rundll_loading_dll_by_ordinal.md
+++ b/docs/_posts/2022-02-08-rundll_loading_dll_by_ordinal.md
@@ -113,8 +113,8 @@ The following analytic identifies rundll32.exe loading an export function by ord
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **rundll_loading_dll_by_ordinal_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-02-15-windows_diskshadow_proxy_execution.md b/docs/_posts/2022-02-15-windows_diskshadow_proxy_execution.md
index 71d2b5ea18..b6523746c1 100644
--- a/docs/_posts/2022-02-15-windows_diskshadow_proxy_execution.md
+++ b/docs/_posts/2022-02-15-windows_diskshadow_proxy_execution.md
@@ -106,8 +106,8 @@ DiskShadow.exe is a Microsoft Signed binary present on Windows Server. It has a
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_diskshadow](https://github.com/splunk/security_content/blob/develop/macros/process_diskshadow.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_diskshadow](https://github.com/splunk/security_content/blob/develop/macros/process_diskshadow.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **windows_diskshadow_proxy_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-02-17-windows_raw_access_to_master_boot_record_drive.md b/docs/_posts/2022-02-17-windows_raw_access_to_master_boot_record_drive.md
index f5db7edcb5..27f66158ab 100644
--- a/docs/_posts/2022-02-17-windows_raw_access_to_master_boot_record_drive.md
+++ b/docs/_posts/2022-02-17-windows_raw_access_to_master_boot_record_drive.md
@@ -112,8 +112,8 @@ This analytic is to look for suspicious raw access read to drive where the maste
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 Note that **windows_raw_access_to_master_boot_record_drive_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-02-18-detect_regasm_with_network_connection.md b/docs/_posts/2022-02-18-detect_regasm_with_network_connection.md
index 697c39bd16..33ed55e6c3 100644
--- a/docs/_posts/2022-02-18-detect_regasm_with_network_connection.md
+++ b/docs/_posts/2022-02-18-detect_regasm_with_network_connection.md
@@ -111,8 +111,8 @@ The following analytic identifies regasm.exe with a network connection to a publ
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 Note that **detect_regasm_with_network_connection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-02-18-detect_regsvcs_with_network_connection.md b/docs/_posts/2022-02-18-detect_regsvcs_with_network_connection.md
index 24486be582..5fcf4a6cbc 100644
--- a/docs/_posts/2022-02-18-detect_regsvcs_with_network_connection.md
+++ b/docs/_posts/2022-02-18-detect_regsvcs_with_network_connection.md
@@ -111,8 +111,8 @@ The following analytic identifies Regsvcs.exe with a network connection to a pub
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 Note that **detect_regsvcs_with_network_connection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-02-18-disabled_kerberos_pre-authentication_discovery_with_powerview.md b/docs/_posts/2022-02-18-disabled_kerberos_pre-authentication_discovery_with_powerview.md
index e1c59dcffd..c8fb7b42bc 100644
--- a/docs/_posts/2022-02-18-disabled_kerberos_pre-authentication_discovery_with_powerview.md
+++ b/docs/_posts/2022-02-18-disabled_kerberos_pre-authentication_discovery_with_powerview.md
@@ -153,4 +153,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/disabled_kerberos_pre-authentication_discovery_with_powerview.yml) \| *version*: **1**
\ No newline at end of file
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-02-18-process_deleting_its_process_file_path.md b/docs/_posts/2022-02-18-process_deleting_its_process_file_path.md
index 3eeb6d0ab4..2fa3827afe 100644
--- a/docs/_posts/2022-02-18-process_deleting_its_process_file_path.md
+++ b/docs/_posts/2022-02-18-process_deleting_its_process_file_path.md
@@ -103,8 +103,8 @@ This detection is to identify a suspicious process that tries to delete the proc
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 Note that **process_deleting_its_process_file_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-02-18-rundll32_dnsquery.md b/docs/_posts/2022-02-18-rundll32_dnsquery.md
index 640a455271..a1454b06df 100644
--- a/docs/_posts/2022-02-18-rundll32_dnsquery.md
+++ b/docs/_posts/2022-02-18-rundll32_dnsquery.md
@@ -106,8 +106,8 @@ This search is to detect a suspicious rundll32.exe process having a http connect
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 Note that **rundll32_dnsquery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-02-22-disabled_kerberos_pre-authentication_discovery_with_get-aduser.md b/docs/_posts/2022-02-22-disabled_kerberos_pre-authentication_discovery_with_get-aduser.md
index f20f996b8e..71b824e3ab 100644
--- a/docs/_posts/2022-02-22-disabled_kerberos_pre-authentication_discovery_with_get-aduser.md
+++ b/docs/_posts/2022-02-22-disabled_kerberos_pre-authentication_discovery_with_get-aduser.md
@@ -153,4 +153,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/disabled_kerberos_pre-authentication_discovery_with_get-aduser.yml) \| *version*: **1**
\ No newline at end of file
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-02-22-kerberos_pre-authentication_flag_disabled_in_useraccountcontrol.md b/docs/_posts/2022-02-22-kerberos_pre-authentication_flag_disabled_in_useraccountcontrol.md
index 10185d2ffd..3b5c7a29f2 100644
--- a/docs/_posts/2022-02-22-kerberos_pre-authentication_flag_disabled_in_useraccountcontrol.md
+++ b/docs/_posts/2022-02-22-kerberos_pre-authentication_flag_disabled_in_useraccountcontrol.md
@@ -151,4 +151,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/kerberos_pre-authentication_flag_disabled_in_useraccountcontrol.yml) \| *version*: **1**
\ No newline at end of file
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-02-23-kerberos_pre-authentication_flag_disabled_with_powershell.md b/docs/_posts/2022-02-23-kerberos_pre-authentication_flag_disabled_with_powershell.md
index 82db512bd7..9528d9f618 100644
--- a/docs/_posts/2022-02-23-kerberos_pre-authentication_flag_disabled_with_powershell.md
+++ b/docs/_posts/2022-02-23-kerberos_pre-authentication_flag_disabled_with_powershell.md
@@ -149,4 +149,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/kerberos_pre-authentication_flag_disabled_with_powershell.yml) \| *version*: **1**
\ No newline at end of file
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-02-23-windows_excessive_disabled_services_event.md b/docs/_posts/2022-02-23-windows_excessive_disabled_services_event.md
index 2b50b29d1e..f9f0572550 100644
--- a/docs/_posts/2022-02-23-windows_excessive_disabled_services_event.md
+++ b/docs/_posts/2022-02-23-windows_excessive_disabled_services_event.md
@@ -113,8 +113,8 @@ This analytic will identify suspicious excessive number of system events of serv
 
 #### Macros
 The SPL above uses the following Macros:
-* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml)
 
 Note that **windows_excessive_disabled_services_event_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-02-25-windows_raw_access_to_disk_volume_partition.md b/docs/_posts/2022-02-25-windows_raw_access_to_disk_volume_partition.md
index 09fa8ebf84..819ed31cf9 100644
--- a/docs/_posts/2022-02-25-windows_raw_access_to_disk_volume_partition.md
+++ b/docs/_posts/2022-02-25-windows_raw_access_to_disk_volume_partition.md
@@ -112,8 +112,8 @@ This analytic is to look for suspicious raw access read to device disk partition
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 Note that **windows_raw_access_to_disk_volume_partition_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-03-03-aws_createaccesskey.md b/docs/_posts/2022-03-03-aws_createaccesskey.md
index aadceda6d0..6dd7347cd5 100644
--- a/docs/_posts/2022-03-03-aws_createaccesskey.md
+++ b/docs/_posts/2022-03-03-aws_createaccesskey.md
@@ -113,8 +113,8 @@ This search looks for AWS CloudTrail events where a user A who has already permi
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that **aws_createaccesskey_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-03-03-aws_updateloginprofile.md b/docs/_posts/2022-03-03-aws_updateloginprofile.md
index 0a3fd5cbb0..ecbe2fa65c 100644
--- a/docs/_posts/2022-03-03-aws_updateloginprofile.md
+++ b/docs/_posts/2022-03-03-aws_updateloginprofile.md
@@ -113,8 +113,8 @@ This search looks for AWS CloudTrail events where a user A who has already permi
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that **aws_updateloginprofile_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-03-15-detect_regsvcs_with_no_command_line_arguments.md b/docs/_posts/2022-03-15-detect_regsvcs_with_no_command_line_arguments.md
index 1b09ce3473..3cf6122082 100644
--- a/docs/_posts/2022-03-15-detect_regsvcs_with_no_command_line_arguments.md
+++ b/docs/_posts/2022-03-15-detect_regsvcs_with_no_command_line_arguments.md
@@ -114,8 +114,8 @@ The following analytic identifies regsvcs.exe with no command line arguments. Th
 #### Macros
 The SPL above uses the following Macros:
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_regsvcs](https://github.com/splunk/security_content/blob/develop/macros/process_regsvcs.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **detect_regsvcs_with_no_command_line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-03-15-rundll32_with_no_command_line_arguments_with_network.md b/docs/_posts/2022-03-15-rundll32_with_no_command_line_arguments_with_network.md
index 5b1e8c6a28..98a8c001df 100644
--- a/docs/_posts/2022-03-15-rundll32_with_no_command_line_arguments_with_network.md
+++ b/docs/_posts/2022-03-15-rundll32_with_no_command_line_arguments_with_network.md
@@ -118,8 +118,8 @@ The following analytic identifies rundll32.exe with no command line arguments an
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **rundll32_with_no_command_line_arguments_with_network_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-03-15-suspicious_dllhost_no_command_line_arguments.md b/docs/_posts/2022-03-15-suspicious_dllhost_no_command_line_arguments.md
index a4a191a48b..b5079114dd 100644
--- a/docs/_posts/2022-03-15-suspicious_dllhost_no_command_line_arguments.md
+++ b/docs/_posts/2022-03-15-suspicious_dllhost_no_command_line_arguments.md
@@ -104,8 +104,8 @@ The following analytic identifies DLLHost.exe with no command line arguments. It
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_dllhost](https://github.com/splunk/security_content/blob/develop/macros/process_dllhost.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_dllhost](https://github.com/splunk/security_content/blob/develop/macros/process_dllhost.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **suspicious_dllhost_no_command_line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-03-15-suspicious_gpupdate_no_command_line_arguments.md b/docs/_posts/2022-03-15-suspicious_gpupdate_no_command_line_arguments.md
index e440403f8a..ff9cc07e7f 100644
--- a/docs/_posts/2022-03-15-suspicious_gpupdate_no_command_line_arguments.md
+++ b/docs/_posts/2022-03-15-suspicious_gpupdate_no_command_line_arguments.md
@@ -104,8 +104,8 @@ The following analytic identifies gpupdate.exe with no command line arguments. I
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_gpupdate](https://github.com/splunk/security_content/blob/develop/macros/process_gpupdate.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_gpupdate](https://github.com/splunk/security_content/blob/develop/macros/process_gpupdate.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **suspicious_gpupdate_no_command_line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-03-15-suspicious_rundll32_no_command_line_arguments.md b/docs/_posts/2022-03-15-suspicious_rundll32_no_command_line_arguments.md
index d4c94d6bfe..3707383ea3 100644
--- a/docs/_posts/2022-03-15-suspicious_rundll32_no_command_line_arguments.md
+++ b/docs/_posts/2022-03-15-suspicious_rundll32_no_command_line_arguments.md
@@ -118,8 +118,8 @@ The following analytic identifies rundll32.exe with no command line arguments. I
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **suspicious_rundll32_no_command_line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-03-16-windows_installutil_remote_network_connection.md b/docs/_posts/2022-03-16-windows_installutil_remote_network_connection.md
index 0585252a58..ddac36a39b 100644
--- a/docs/_posts/2022-03-16-windows_installutil_remote_network_connection.md
+++ b/docs/_posts/2022-03-16-windows_installutil_remote_network_connection.md
@@ -116,8 +116,8 @@ During triage review resulting network connections, file modifications, and para
 #### Macros
 The SPL above uses the following Macros:
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **windows_installutil_remote_network_connection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-03-16-windows_installutil_uninstall_option_with_network.md b/docs/_posts/2022-03-16-windows_installutil_uninstall_option_with_network.md
index 42ed4b524f..6bbba331d6 100644
--- a/docs/_posts/2022-03-16-windows_installutil_uninstall_option_with_network.md
+++ b/docs/_posts/2022-03-16-windows_installutil_uninstall_option_with_network.md
@@ -117,8 +117,8 @@ During triage review resulting network connections, file modifications, and para
 #### Macros
 The SPL above uses the following Macros:
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that **windows_installutil_uninstall_option_with_network_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-03-24-splunk_dos_via_malformed_s2s_request.md b/docs/_posts/2022-03-24-splunk_dos_via_malformed_s2s_request.md
index 0c17715d52..737a8e6d4d 100644
--- a/docs/_posts/2022-03-24-splunk_dos_via_malformed_s2s_request.md
+++ b/docs/_posts/2022-03-24-splunk_dos_via_malformed_s2s_request.md
@@ -92,7 +92,7 @@ On March 24th, 2022, Splunk published a security advisory for a possible Denial
 <div markdown="1">
 | ID          | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
 | ----------- | ----------- | -------------- |
-| [CVE-2021-3422](https://nvd.nist.gov/vuln/detail/CVE-2021-3422) | The lack of validation of a key-value field in the Splunk-to-Splunk protocol results in a denial-of-service in Splunk Enterprise instances configured to index Universal Forwarder traffic. The vulnerability impacts Splunk Enterprise versions before 7.3.9, 8.0 versions before 8.0.9, and 8.1 versions before 8.1.3. It does not impact Universal Forwarders. When Splunk forwarding is secured using TLS or a Token, the attack requires compromising the certificate or token, or both. Implementation of either or both reduces the severity to Medium. | None |
+| [CVE-2021-3422](https://nvd.nist.gov/vuln/detail/CVE-2021-3422) | The lack of validation of a key-value field in the Splunk-to-Splunk protocol results in a denial-of-service in Splunk Enterprise instances configured to index Universal Forwarder traffic. The vulnerability impacts Splunk Enterprise versions before 7.3.9, 8.0 versions before 8.0.9, and 8.1 versions before 8.1.3. It does not impact Universal Forwarders. When Splunk forwarding is secured using TLS or a Token, the attack requires compromising the certificate or token, or both. Implementation of either or both reduces the severity to Medium. | 4.3 |
 
 
 
diff --git a/docs/_posts/2022-03-28-windows_terminating_lsass_process.md b/docs/_posts/2022-03-28-windows_terminating_lsass_process.md
index 9dfd2c5d9e..1a620cbbac 100644
--- a/docs/_posts/2022-03-28-windows_terminating_lsass_process.md
+++ b/docs/_posts/2022-03-28-windows_terminating_lsass_process.md
@@ -111,8 +111,8 @@ This analytic is to detect a suspicious process terminating Lsass process. Lsass
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 Note that **windows_terminating_lsass_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-04-04-github_actions_disable_security_workflow.md b/docs/_posts/2022-04-04-github_actions_disable_security_workflow.md
new file mode 100644
index 0000000000..8e7431bdff
--- /dev/null
+++ b/docs/_posts/2022-04-04-github_actions_disable_security_workflow.md
@@ -0,0 +1,170 @@
+---
+title: "GitHub Actions Disable Security Workflow"
+excerpt: "Compromise Software Supply Chain
+, Supply Chain Compromise
+"
+categories:
+  - Cloud
+last_modified_at: 2022-04-04
+toc: true
+toc_label: ""
+tags:
+  - Compromise Software Supply Chain
+  - Supply Chain Compromise
+  - Initial Access
+  - Initial Access
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+This search detects a disabled security workflow in GitHub Actions. An attacker can disable a security workflow in GitHub actions to hide malicious code in it.
+
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+
+- **Last Updated**: 2022-04-04
+- **Author**: Patrick Bareiss, Splunk
+- **ID**: 0459f1a5-c0ac-4987-82d6-65081209f854
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1195.002](https://attack.mitre.org/techniques/T1195/002/) | Compromise Software Supply Chain | Initial Access |
+
+| [T1195](https://attack.mitre.org/techniques/T1195/) | Supply Chain Compromise | Initial Access |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Actions on Objectives
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+* PR.DS
+* PR.AC
+* DE.CM
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+* CIS 13
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+
+
+</div>
+</details>
+
+#### Search
+
+```
+`github` workflow_run.event=push OR workflow_run.event=pull_request 
+| stats values(workflow_run.name) as workflow_run.name by workflow_run.head_commit.id workflow_run.event workflow_run.head_branch workflow_run.head_commit.author.email workflow_run.head_commit.author.name workflow_run.head_commit.message workflow_run.head_commit.timestamp workflow_run.head_repository.full_name workflow_run.head_repository.owner.id workflow_run.head_repository.owner.login workflow_run.head_repository.owner.type 
+| rename workflow_run.head_commit.author.name as user, workflow_run.head_commit.author.email as user_email, workflow_run.head_repository.full_name as repository, workflow_run.head_branch as branch 
+| search NOT workflow_run.name=*security-testing* 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `github_actions_disable_security_workflow_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml)
+
+Note that **github_actions_disable_security_workflow_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* workflow_run.event
+* workflow_run.name
+* workflow_run.head_commit.id
+* workflow_run.event workflow_run.head_branch
+* workflow_run.head_commit.author.email
+* workflow_run.head_commit.author.name
+* workflow_run.head_commit.message
+* workflow_run.head_commit.timestamp
+* workflow_run.head_repository.full_name
+* workflow_run.head_repository.owner.id
+* workflow_run.head_repository.owner.login
+* workflow_run.head_repository.owner.type
+
+
+#### How To Implement
+You must index GitHub logs. You can follow the url in reference to onboard GitHub logs. Sometimes GitHub logs are truncated, make sure to disable it in props.conf. Replace *security-testing* with the name of your security testing workflow in GitHub Actions.
+
+#### Known False Positives
+unknown
+
+#### Associated Analytic story
+* [Dev Sec Ops](/stories/dev_sec_ops)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 27.0 | 30 | 90 | Security Workflow is disabled in branch $branch$ for repository $repository$ |
+
+
+#### Reference
+
+* [https://www.splunk.com/en_us/blog/tips-and-tricks/getting-github-data-with-webhooks.html](https://www.splunk.com/en_us/blog/tips-and-tricks/getting-github-data-with-webhooks.html)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1195.002/github_actions_disable_security_workflow/github_actions_disable_security_workflow.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1195.002/github_actions_disable_security_workflow/github_actions_disable_security_workflow.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/cloud/github_actions_disable_security_workflow.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-04-04-windows_event_for_service_disabled.md b/docs/_posts/2022-04-04-windows_event_for_service_disabled.md
new file mode 100644
index 0000000000..efdc32bf2b
--- /dev/null
+++ b/docs/_posts/2022-04-04-windows_event_for_service_disabled.md
@@ -0,0 +1,163 @@
+---
+title: "Windows Event For Service Disabled"
+excerpt: "Disable or Modify Tools
+, Impair Defenses
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-04-04
+toc: true
+toc_label: ""
+tags:
+  - Disable or Modify Tools
+  - Impair Defenses
+  - Defense Evasion
+  - Defense Evasion
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+This analytic will identify suspicious system event of services that was modified from start to disabled. This technique is seen where the adversary attempts to disable security app services, other malware services to evade the defense systems on the compromised host
+
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-04-04
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: 9c2620a8-94a1-11ec-b40c-acde48001122
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion |
+
+| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Exploitation
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+* DE.CM
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+
+
+</div>
+</details>
+
+#### Search
+
+```
+`wineventlog_system` EventCode=7040  Message = "*service was changed from demand start to disabled." 
+| stats count min(_time) as firstTime max(_time) as lastTime by ComputerName EventCode Message User Sid service service_name 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `windows_event_for_service_disabled_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml)
+
+Note that **windows_event_for_service_disabled_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* ComputerName
+* EventCode
+* Message
+* User
+* Sid
+
+
+#### How To Implement
+To successfully implement this search, you need to be ingesting logs with the Service name, Service File Name Service Start type, and Service Type from your endpoints.
+
+#### Known False Positives
+Windows service update may cause this event. In that scenario, filtering is needed.
+
+#### Associated Analytic story
+* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 36.0 | 60 | 60 | Service was disabled on $Computer$ |
+
+
+#### Reference
+
+* [https://blog.talosintelligence.com/2018/02/olympic-destroyer.html](https://blog.talosintelligence.com/2018/02/olympic-destroyer.html)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/olympic_destroyer/system.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/olympic_destroyer/system.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_event_for_service_disabled.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_stories/dev_sec_ops.md b/docs/_stories/dev_sec_ops.md
index 83abc82d01..4d6b59a19b 100644
--- a/docs/_stories/dev_sec_ops.md
+++ b/docs/_stories/dev_sec_ops.md
@@ -40,6 +40,7 @@ DevSecOps is a collaborative framework, which thinks about application and infra
 | [Circle CI Disable Security Step](/cloud/circle_ci_disable_security_step/) | [Compromise Client Software Binary](/tags/#compromise-client-software-binary)| Anomaly |
 | [Correlation by Repository and Risk](/cloud/correlation_by_repository_and_risk/) | [Malicious Image](/tags/#malicious-image), [User Execution](/tags/#user-execution)| Correlation |
 | [Correlation by User and Risk](/cloud/correlation_by_user_and_risk/) | [Malicious Image](/tags/#malicious-image), [User Execution](/tags/#user-execution)| Correlation |
+| [GitHub Actions Disable Security Workflow](/cloud/github_actions_disable_security_workflow/) | [Compromise Software Supply Chain](/tags/#compromise-software-supply-chain), [Supply Chain Compromise](/tags/#supply-chain-compromise)| Anomaly |
 | [Github Commit Changes In Master](/cloud/github_commit_changes_in_master/) | [Trusted Relationship](/tags/#trusted-relationship)| Anomaly |
 | [Github Commit In Develop](/cloud/github_commit_in_develop/) | [Trusted Relationship](/tags/#trusted-relationship)| Anomaly |
 | [GitHub Dependabot Alert](/cloud/github_dependabot_alert/) | [Compromise Software Dependencies and Development Tools](/tags/#compromise-software-dependencies-and-development-tools), [Supply Chain Compromise](/tags/#supply-chain-compromise)| Anomaly |