diff --git a/.github/workflows/build-and-validate.yml b/.github/workflows/build-and-validate.yml
index 8bde3c2b45..9062ef3a8c 100644
--- a/.github/workflows/build-and-validate.yml
+++ b/.github/workflows/build-and-validate.yml
@@ -23,7 +23,7 @@ jobs:
 
     steps:
       - name: TAGGED, Validate that the tag is in the correct format
-        
+
         run: |
           echo "The GITHUB_REF: $GITHUB_REF"
           #First check to see if the release is a tag
@@ -32,7 +32,7 @@ jobs:
             #is in the correct format (like v1.10.20)
             if [[ $GITHUB_REF =~ refs/tags/v[0-9]+.[0-9]+.[0-9]+ ]]; then
               echo "PASS: Tagged release with good format"
-              exit 0 
+              exit 0
             else
               echo "FAIL: Tagged release with bad format"
               exit 1
@@ -49,14 +49,14 @@ jobs:
     runs-on: ubuntu-latest
     needs: [validate-tag-if-present]
     steps:
-      #Previous config chose which branch/tag to operate on. 
+      #Previous config chose which branch/tag to operate on.
       #I think Github is smart enough to choose based on whether it's a pull request or push + other info?
-      - name: Check out the repository code 
+      - name: Check out the repository code
         uses: actions/checkout@v2
         #with:
         #  repository: splunk/security-content #check out https://github.com/mitre/cti.git, defaults to HEAD
         #  path: "security-content"
-      
+
 
       - uses: actions/setup-python@v2
         with:
@@ -66,14 +66,14 @@ jobs:
 
       #TODO: CircleCI restore_cache equivalent
 
-      #don't need to install python3 or python3-dev since it was handled by the action above?  
+      #don't need to install python3 or python3-dev since it was handled by the action above?
       #Also, no support for YAML anchors/aliases in Github Actions...
       - name: Install System Packages
-        run: | 
+        run: |
           sudo apt update -qq
-          sudo apt install jq -qq          
-      #TODO: CircleCI save_cache equivalent    
-      
+          sudo apt install jq -qq
+      #TODO: CircleCI save_cache equivalent
+
       - name: Install Python Dependencies
         run: |
           #Get the virtualenv set up
@@ -83,19 +83,19 @@ jobs:
           python3 -m pip install --upgrade pip
           python3 -m pip install wheel
           python3 -m pip install -q -r requirements.txt
-      
 
-      - name: run validate  
-        run: | 
+
+      - name: run validate
+        run: |
           source venv/bin/activate
           python3 contentctl.py --path . --verbose validate
 
-      - name: Get CTI Repo for Mitre context 
-        uses:  actions/checkout@v2  
+      - name: Get CTI Repo for Mitre context
+        uses:  actions/checkout@v2
         with:
           repository: mitre/cti #check out https://github.com/mitre/cti.git, defaults to HEAD
           path: "cti/"
-          
+
 
       #Now generate the documentation (uses Node)
       - uses: actions/setup-node@v2
@@ -108,18 +108,18 @@ jobs:
           #Enter the virtualenv and run the docgen
           source venv/bin/activate
           python3 bin/doc_gen.py --path . --output docs -v
-          
+
           #Now generate the spec docs
           npm install -g @adobe/jsonschema2md
           jsonschema2md -d spec -o docs/spec -f yaml -e spec.json -x -
 
           #Clean up extra properties on docs
           rm -rf docs/spec/*-*.md
-          
+
           echo "****** BRANCH INFORMATION ******"
           git branch
           git branch --show-current
-      
+
   build-sources:
     runs-on: ubuntu-latest
     needs: validate-content
@@ -128,10 +128,10 @@ jobs:
         uses: actions/checkout@v2
 
       - name: Install System Packages
-        run: | 
+        run: |
           sudo apt update -qq
-          sudo apt install jq -qq          
-      
+          sudo apt install jq -qq
+
       - name: Install Python Dependencies
         run: |
           #Get the virtualenv set up
@@ -143,18 +143,15 @@ jobs:
           python3 -m pip install -q -r requirements.txt
 
       - name: Run Generate
-        run: | 
+        run: |
           source venv/bin/activate
           python3 contentctl.py --path . --verbose generate --product ESCU --output dist/escu
           python3 contentctl.py --path . --verbose generate --product SAAWS --output dist/saaws
           python3 contentctl.py --path . --verbose generate --product DevSecOps --output dist/devsecops
-          # make a copy of use_case_lib in order to have ES work :-(
-          # cp dist/escu/default/use_case_library.conf dist/escu/default/analyticstories.conf
-          # cp dist/saaws/default/use_case_library.conf dist/saaws/default/analyticstories.conf
-          # cp dist/devsecops/default/use_case_library.conf dist/devsecops/default/analyticstories.conf
+          python3 contentctl.py --path . --verbose generate --product SSA --output dist/ssa
 
       - name: Copy lookups .csv files
-        run: | 
+        run: |
           # clean up current lookups
           rm -rf dist/escu/lookups
           rm -rf dist/saaws/lookups
@@ -167,7 +164,7 @@ jobs:
           cp -rv *.csv ../dist/escu/lookups
           cp -rv *.csv ../dist/saaws/lookups
           cp -rv *.csv ../dist/devsecops/lookups
-      
+
       #Tag is '' for non-tagged push and the tag name for a tagged release
       - name: Set tag
         id: vars
@@ -198,7 +195,7 @@ jobs:
             sed -i "s/\"version\": .*$/\"version\": \"$CONTENT_VERSION\"/g" dist/escu/app.manifest
             sed -i "s/version = .*$/version = $CONTENT_VERSION/g" dist/escu/default/content-version.conf
             tar -czf content-pack-build-escu.tar.gz dist/escu/*
-            
+
             # update build number and version for saaws
             sed -i "s/build = .*$/build = ${{ github.run_number }}/g" dist/saaws/default/app.conf
             sed -i "s/^version = .*$/version = $CONTENT_VERSION/g" dist/saaws/default/app.conf
@@ -209,6 +206,9 @@ jobs:
             # update build number and version for devsecops
             tar -czf content-pack-build-devsecops.tar.gz dist/devsecops/*
 
+            # update build number and version for ssa
+            tar -czf content-pack-build-ssa.tar.gz dist/ssa/*
+
       - name: Persist to Workspace
         uses: actions/upload-artifact@v2
         with:
@@ -217,12 +217,13 @@ jobs:
             content-pack-build-escu.tar.gz
             content-pack-build-saaws.tar.gz
             content-pack-build-devsecops.tar.gz
-            
+            content-pack-build-ssa.tar.gz
+
 
   build-package:
     runs-on: ubuntu-latest
     needs: [validate-content, build-sources]
-    
+
     steps:
       - uses: actions/download-artifact@v2
         with:
@@ -234,12 +235,12 @@ jobs:
         with:
           python-version: '2.7' #Available versions here - https://github.com/actions/python-versions/releases  easy to change/make a matrix/use pypy
           architecture: 'x64' # optional x64 or x86. Defaults to x64 if not specified
-      
+
       - name: Get virtualenv for Python 2.7
         run: |
-          sudo apt install virtualenv 
+          sudo apt install virtualenv
 
-      - name: Grab Splunk Packaging Toolkit    
+      - name: Grab Splunk Packaging Toolkit
         run : |
           curl -Ls https://download.splunk.com/misc/packaging-toolkit/splunk-packaging-toolkit-0.9.0.tar.gz -o splunk-packaging-toolkit-latest.tar.gz
           mkdir slim-latest
@@ -264,6 +265,7 @@ jobs:
           mv dist/escu DA-ESS-ContentUpdate
           mv dist/saaws DA-ESS_AmazonWebServices_Content
           mv dist/devsecops dev_sec_ops_analytics
+
           slim package -o upload DA-ESS-ContentUpdate
           slim package -o upload DA-ESS_AmazonWebServices_Content
           slim package -o upload dev_sec_ops_analytics
@@ -276,6 +278,9 @@ jobs:
 
           cp upload/dev_sec_ops_analytics-*tar.gz dev_sec_ops_analytics-latest.tar.gz
 
+          cp content-pack-build-ssa.tar.gz upload/SSA_Content-latest.tar.gz
+          sha256sum upload/SSA_Content-latest.tar.gz >> checksum.txt
+
           touch tag-canary.txt
 
       - name: store_artifacts
@@ -292,8 +297,9 @@ jobs:
             build/DA-ESS-ContentUpdate-latest.tar.gz
             build/DA-ESS_AmazonWebServices_Content-latest.tar.gz
             build/dev_sec_ops_analytics-latest.tar.gz
+            build/SSA_Content-latest.tar.gz
             build/checksum.txt
-      
+
 
   #Everything below this line should ONLY run on a tag and nothing else
   #We still want all of the above checks to run and pass before running these
@@ -301,7 +307,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [validate-content, build-sources, build-package]
     #Only run when tagged
-    if: startsWith(github.ref, 'refs/tags/') 
+    if: startsWith(github.ref, 'refs/tags/')
     steps:
 
       - name: Checkout Repo
@@ -319,10 +325,10 @@ jobs:
 
 
       - name: Install System Packages
-        run: | 
+        run: |
           sudo apt update -qq
           sudo apt install jq -qq
-      
+
 
 
       - name: Submit ESCU Package to AppInspect API
@@ -333,8 +339,8 @@ jobs:
           cd bin
           #Enclose in quotes in case there are any special characters in the username/password
           #Better not to pass these arguments on the command line, if possible
-          ./appinspect.sh ../ DA-ESS-ContentUpdate-latest.tar.gz "$APPINSPECT_USERNAME" "$APPINSPECT_PASSWORD" 
-      
+          ./appinspect.sh ../ DA-ESS-ContentUpdate-latest.tar.gz "$APPINSPECT_USERNAME" "$APPINSPECT_PASSWORD"
+
       - name: Submit SAAWS Package to AppInspect API
         env:
           APPINSPECT_USERNAME: ${{ secrets.AppInspectUsername }}
@@ -342,20 +348,20 @@ jobs:
         run: |
           cd bin
           ./appinspect.sh ../ DA-ESS_AmazonWebServices_Content-latest.tar.gz "$APPINSPECT_USERNAME" "$APPINSPECT_PASSWORD"
-      
+
       - name: Create report artifact
         if: always()
         run: |
           #Always create this, regardless of whether success or failure above
           tar -cvzf report.tar.gz report/
 
-      - name: store_artifacts 
+      - name: store_artifacts
         uses: actions/upload-artifact@v2
         with:
           name: appinspect_reports
           path: |
             report.tar.gz
-            
+
       #Still store the report, even if we have failed (otherwise we don't know why/how we failed)
       - name: store_artifacts_on_failure
         uses: actions/upload-artifact@v2
@@ -364,7 +370,7 @@ jobs:
           name: appinspect_reports_failure
           path: |
             report.tar.gz
-  
+
   create-report:
     runs-on: ubuntu-latest
     needs: [validate-content, build-sources, build-package, run-appinspect]
@@ -375,13 +381,13 @@ jobs:
         uses: actions/checkout@v2
         with:
           ref: 'develop'
-      
-      
+
+
       - name: Install System Packages
-        run: | 
+        run: |
           sudo apt update -qq
           sudo apt install jq -qq
-      
+
       - uses: actions/setup-python@v2
         with:
           python-version: '3.9' #Available versions here - https://github.com/actions/python-versions/releases  easy to change/make a matrix/use pypy
@@ -396,12 +402,12 @@ jobs:
           python3 -m pip install --upgrade pip
           python3 -m pip install wheel
           python3 -m pip install -q -r requirements.txt
-      
+
       - name: run reporting
-        run: | 
+        run: |
           source venv/bin/activate
           python3 bin/reporting.py
-      
+
       #Official, Verified Amazon-AWS Github Account Provided Action
       - uses: aws-actions/configure-aws-credentials@v1
         with:
@@ -410,23 +416,23 @@ jobs:
           # aws-session-token: ${{ secrets.AWS_SESSION_TOKEN }} # if you have/need it
           aws-region: us-west-1 #assume we will always use this, could make this an environment variable...
 
-      - name: Upload Reporting 
+      - name: Upload Reporting
         run: |
           aws s3 cp bin/reporting s3://security-content/reporting --recursive --exclude "*" --include "*.svg"
-      
+
   update-sources-github:
     runs-on: ubuntu-latest
     needs: [validate-content, build-sources, build-package, run-appinspect, create-report]
     #Only run when tagged
     if: startsWith(github.ref, 'refs/tags/')
-    steps: 
+    steps:
 
       - name: Checkout Repo
         uses: actions/checkout@v2
         with:
           token: ${{ secrets.PROTECTED_BRANCH_PUSH_TOKEN }}
           ref: 'develop'
-      
+
       - uses: actions/setup-python@v2
         with:
           python-version: '3.9' #Available versions here - https://github.com/actions/python-versions/releases  easy to change/make a matrix/use pypy
@@ -443,6 +449,8 @@ jobs:
           tar -zxf DA-ESS-ContentUpdate-latest.tar.gz -C latest-escu --strip-components=1
           mkdir latest-saaws
           tar -zxf DA-ESS_AmazonWebServices_Content-latest.tar.gz -C latest-saaws --strip-components=1
+          mkdir latest-ssa
+          tar -zxf SSA_Content-latest.tar.gz -C latest-saaws --strip-components=1
       - name: Install Python Dependencies
         run: |
           #Get the virtualenv set up
@@ -452,9 +460,9 @@ jobs:
           python3 -m pip install --upgrade pip
           python3 -m pip install wheel
           python3 -m pip install -q -r requirements.txt
-      
-      - name: Get CTI Repo for Mitre context 
-        uses:  actions/checkout@v2  
+
+      - name: Get CTI Repo for Mitre context
+        uses:  actions/checkout@v2
         with:
           repository: mitre/cti #check out https://github.com/mitre/cti.git, defaults to HEAD
           path: "cti/"
@@ -463,33 +471,30 @@ jobs:
         id: vars
         run: |
           echo "::set-output name=branch::${GITHUB_REF#refs/heads/}"
-      
-      - name: Run doc-gen 
-        run: |
-          source venv/bin/activate 
-          python3 bin/doc_gen.py --path . --output docs -v
-      
-      - name: Make YAMLs Pretty 
+
+      - name: Run doc-gen
         run: |
           source venv/bin/activate
-          python3 bin/pretty_yaml.py --path . -v 
+          python3 bin/doc_gen.py --path . --output docs -v
+
+      - name: Make YAMLs Pretty
+        run: |
+          source venv/bin/activate
+          python3 bin/pretty_yaml.py --path . -v
 
       - name: Run generate-coverage-map
         run: |
           source venv/bin/activate
           python3 bin/generate-coverage-map.py --projects_path . --output docs/mitre-map
-      
+
       - name: Update github with new docs and package bits
         run: |
           rm -rf dist
           mkdir dist
-          echo "Directory layout 3"
-          pwd
-          ls -lah
           mv latest-escu dist/escu
           mv latest-saaws dist/saaws
+          mv latest-ssa dist/ssa
           # configure git to prep for commit
-          #git config credential.helper 'cache --timeout=120'
           git config user.email "research@splunk.com"
           git config user.name "research bot"
           git config --global push.default simple
@@ -500,7 +505,7 @@ jobs:
           # Push quietly to prevent showing the token in log
           #No need to provide any credentials
           git push
-      
+
 
   publish-github-release:
     #Github-maintained release action is in archived state: https://github.com/actions/create-release
@@ -510,7 +515,7 @@ jobs:
     #Only run when tagged
     if: startsWith(github.ref, 'refs/tags/')
     steps:
-      
+
       #Get the artifacts that we need
       - uses: actions/download-artifact@v2
         with:
@@ -520,23 +525,24 @@ jobs:
         with:
           name: appinspect_reports
 
-      
-      
+
+
       #Rename those artifacts appropriately
       - name: Set tag
         id: vars
         run: echo "::set-output name=tag::${GITHUB_REF#refs/*/}"
 
-      - name: Rename the content-update appropriately 
+      - name: Rename the content-update appropriately
         run: |
           cp DA-ESS-ContentUpdate-latest.tar.gz DA-ESS-ContentUpdate-${{ steps.vars.outputs.tag }}.tar.gz
           cp DA-ESS_AmazonWebServices_Content-latest.tar.gz DA-ESS_AmazonWebServices_Content-${{ steps.vars.outputs.tag }}.tar.gz
-          
+          cp SSA_Content-latest.tar.gz SSA_Content-${{ steps.vars.outputs.tag }}.tar.gz
+
           #No checksum on the reports
           cp report.tar.gz report-${{ steps.vars.outputs.tag }}.tar.gz
-          
+
           cp checksum.txt checksum-${{ steps.vars.outputs.tag }}.txt
-      
+
       #Upload all of the artifacts that we have created using the third party
       #action recommended bu Github
       - name: Upload Release Artifacts
@@ -545,18 +551,19 @@ jobs:
           files: |
             DA-ESS-ContentUpdate-${{ steps.vars.outputs.tag }}.tar.gz
             DA-ESS_AmazonWebServices_Content-${{ steps.vars.outputs.tag }}.tar.gz
+            SSA_Content-${{ steps.vars.outputs.tag }}.tar.gz
             report-${{ steps.vars.outputs.tag }}.tar.gz
             checksum-${{ steps.vars.outputs.tag }}.txt
 
-          
+
 
   attack-range-update:
     runs-on: ubuntu-latest
     needs: [validate-content, build-sources, build-package, run-appinspect, create-report, update-sources-github, publish-github-release]
     #Only run when tagged
     if: startsWith(github.ref, 'refs/tags/')
-    steps:  
-      
+    steps:
+
       #Get the artifacts that we need
       - uses: actions/download-artifact@v2
         with:
@@ -569,20 +576,20 @@ jobs:
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
           # aws-session-token: ${{ secrets.AWS_SESSION_TOKEN }} # if you have/need it
-          aws-region: us-west-1 #assume we will always use this, could make this an environment variable... 
+          aws-region: us-west-1 #assume we will always use this, could make this an environment variable...
 
       - name: Sync latest ESCU to the Attack Range S3 bucket for apps
         run: |
             aws s3 cp DA-ESS-ContentUpdate-latest.tar.gz s3://attack-range-appbinaries/
             # make the file public since it is not by default
             aws s3api put-object-acl --bucket attack-range-appbinaries --key DA-ESS-ContentUpdate-latest.tar.gz --acl public-read
-  
+
   master-api-update:
     runs-on: ubuntu-latest
     needs: [validate-content, build-sources, build-package, run-appinspect, create-report, update-sources-github, publish-github-release, attack-range-update]
     #Only run when tagged
     if: startsWith(github.ref, 'refs/tags/')
-    steps:  
+    steps:
       - name: Checkout Repo
         uses: actions/checkout@v2
         with:
@@ -607,7 +614,7 @@ jobs:
       - name: Create Baseline Folder
         run: |
           source venv/bin/activate
-          python3 bin/create_baseline_folder.py   
+          python3 bin/create_baseline_folder.py
 
       #Official, Verified Amazon-AWS Github Account Provided Action
       - uses: aws-actions/configure-aws-credentials@v1
@@ -615,7 +622,7 @@ jobs:
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
           # aws-session-token: ${{ secrets.AWS_SESSION_TOKEN }} # if you have/need it
-          aws-region: us-west-1 #assume we will always use this, could make this an environment variable... 
+          aws-region: us-west-1 #assume we will always use this, could make this an environment variable...
 
       - name: Update API sources
         run: |
@@ -637,5 +644,3 @@ jobs:
             echo "Error [Security Content API status: $API_STATUS]"
             exit 1
           fi
-
-  
diff --git a/bin/generate.py b/bin/generate.py
index 910b1462af..446c79f3b9 100644
--- a/bin/generate.py
+++ b/bin/generate.py
@@ -92,6 +92,29 @@ def generate_collections_conf(lookups, TEMPLATE_PATH, OUTPUT_PATH):
 
     return output_path
 
+def generate_ssa_yaml(detections, TEMPLATE_PATH, OUTPUT_PATH):
+    '''
+    @param detections: input list of individual YAML detections in detections/ directory
+    @return: the enhanced yaml file located in /detections directory
+    '''
+
+    # disable yaml pointers https://stackoverflow.com/questions/51272814/python-yaml-dumping-pointer-references
+    yaml.Dumper.ignore_aliases = lambda *args : True
+
+    for d in detections:
+        manifest_file = OUTPUT_PATH + '/detections/' + d['name'].lower().replace(" ", "_") + '.yml'
+
+        # remove unused fields
+        del d['risk']
+        del d['deployment']
+        del d['mappings']
+        del d['savedsearch_annotations']
+
+        with open(manifest_file, 'w') as file:
+            documents = yaml.dump(d, file, sort_keys=True)
+
+    return OUTPUT_PATH + '/detections/'
+
 def generate_savedsearches_conf(detections, deployments, TEMPLATE_PATH, OUTPUT_PATH):
     '''
     @param detections: input list of individual YAML detections in detections/ directory
@@ -113,19 +136,6 @@ def generate_savedsearches_conf(detections, deployments, TEMPLATE_PATH, OUTPUT_P
 
     return output_path
 
-# def generate_analytic_story_conf(stories, detections, TEMPLATE_PATH, OUTPUT_PATH):
-#     utc_time = datetime.datetime.utcnow().replace(microsecond=0).isoformat()
-
-#     j2_env = Environment(loader=FileSystemLoader(TEMPLATE_PATH), # nosemgrep
-#                          trim_blocks=True)
-#     template = j2_env.get_template('analytic_stories.j2')
-#     output_path = path.join(OUTPUT_PATH, 'default/analytic_stories.conf')
-#     output = template.render(stories=stories, time=utc_time)
-#     with open(output_path, 'w', encoding="utf-8") as f:
-#         f.write(output)
-
-#     return output_path
-
 def generate_use_case_library_conf(stories, detections, TEMPLATE_PATH, OUTPUT_PATH):
     utc_time = datetime.datetime.utcnow().replace(microsecond=0).isoformat()
 
@@ -245,7 +255,6 @@ def get_deployments(object, deployments):
 
                     for tag_value_deployment in tag_array_deployment:
                         if tag_value == tag_value_deployment:
-                            # print("tag value: {}, matched deployment tag: {} on deployment: {}".format(tag_value,tag_value_deployment, deployment))
                             matched_deployments.append(deployment)
                             continue
 
@@ -257,9 +266,7 @@ def get_deployments(object, deployments):
                     last_deployment = deployment
     else:
         last_deployment = matched_deployments[-1]
-        # last_deployment = replace_vars_in_deployment(last_deployment, object) # Not needed because of custom_jinja2_enrichment_filter
 
-    # print(last_deployment)
     return last_deployment
 
 def get_nes_fields(search, deployment):
@@ -336,18 +343,18 @@ def add_annotations(detection):
                 savedsearch_annotations[key] = detection['tags'][key]
     detection['savedsearch_annotations'] = savedsearch_annotations
 
+    # add SSA risk_severity
+    if 'risk_score' in detection['tags']:
+        if detection['tags']['risk_score'] >= 80:
+            detection['tags']['risk_severity'] = 'high'
+        elif(50>= detection['tags']['risk_score'] <=79):
+            detection['tags']['risk_severity'] = 'medium'
+        else:
+            detection['tags']['risk_severity'] = 'low'
     return detection
 
 def add_rba(detection):
 
-    # removed since this is causing a duplicate bug in ES 6.4+
-    # if 'risk_object' in detection['tags']:
-    #     detection['risk_object'] = detection['tags']['risk_object']
-    # if 'risk_object_type' in detection['tags']:
-    #    detection['risk_object_type'] = detection['tags']['risk_object_type']
-    # if 'risk_score' in detection['tags']:
-    #     detection['risk_score'] = detection['tags']['risk_score']
-
     # grab risk message
     if 'message' in detection['tags']:
         detection['risk_message'] = detection['tags']['message']
@@ -433,7 +440,6 @@ def prepare_detections(detections, deployments, playbooks, OUTPUT_PATH):
             elif detection['type'] == 'Correlation':
                 detection['search'] = detection['search'] + ' | collect index=alerts'
 
-
         # parse out data_models
         data_model = parse_data_models_from_search(detection['search'])
         if data_model:
@@ -465,7 +471,7 @@ def prepare_detections(detections, deployments, playbooks, OUTPUT_PATH):
             if 'product' in detection['tags']:
                 detection['product'] = detection['tags']['product']
 
-            # turn all SAAWS detections
+            # enable all SAAWS detections
             if (OUTPUT_PATH) == 'dist/saaws':
                 detection['disabled'] = 'false'
 
@@ -626,14 +632,17 @@ def compute_objects(objects, PRODUCT, OUTPUT_PATH):
         objects["detections"]  = [object for object in objects["detections"]  if 'Dev Sec Ops Analytics' in object['tags']['product']]
         objects["stories"] = [object for object in objects["stories"] if 'Dev Sec Ops Analytics' in object['tags']['product']]
 
+    if PRODUCT == "ESCU":
+        # only use ESCU detections to the configurations
+        objects["detections"] = sorted(filter(lambda d: not 'Splunk Behavioral Analytics' in d['tags']['product'], objects["detections"]), key=lambda d: d['name'])
+        objects["stories"] = sorted(filter(lambda s: not 'Splunk Behavioral Analytics' in s['tags']['product'], objects["stories"]), key=lambda s: s['name'])
 
-    # only use ESCU detections to the configurations
-    objects["detections"] = sorted(filter(lambda d: not 'Splunk Behavioral Analytics' in d['tags']['product'], objects["detections"]), key=lambda d: d['name'])
-    # only use ESCU stories to the configuration
-    objects["stories"] = sorted(filter(lambda s: not 'Splunk Behavioral Analytics' in s['tags']['product'], objects["stories"]), key=lambda s: s['name'])
+    if PRODUCT == "SSA":
+        # only SSA detections, also no need to calculate stories
+        objects["detections"] = sorted(filter(lambda d: 'Splunk Behavioral Analytics' in d['tags']['product'], objects["detections"]), key=lambda d: d['name'])
+        objects["stories"] = sorted(filter(lambda s: 'Splunk Behavioral Analytics' in s['tags']['product'], objects["stories"]), key=lambda s: s['name'])
 
     objects["macros"] = sorted(objects["macros"], key=lambda m: m['name'])
-
     objects["detections"] = prepare_detections(objects["detections"], objects["deployments"], objects["playbooks"], OUTPUT_PATH)
     objects["stories"] = prepare_stories(objects["stories"], objects["detections"], objects["playbooks"])
 
@@ -654,31 +663,36 @@ def main(REPO_PATH, OUTPUT_PATH, PRODUCT, VERBOSE):
     try:
         if VERBOSE:
             print("generating Mitre lookups")
-        generate_mitre_lookup(OUTPUT_PATH)
+    #    generate_mitre_lookup(OUTPUT_PATH)
     except Exception as e:
         print('Error: ' + str(e))
         print("WARNING: Generation of Mitre lookup failed.")
 
-    lookups_path = generate_transforms_conf(objects["lookups"], TEMPLATE_PATH, OUTPUT_PATH)
-    lookups_path = generate_collections_conf(objects["lookups"], TEMPLATE_PATH, OUTPUT_PATH)
-    lookups_files = generate_lookup_files(objects["lookups"], TEMPLATE_PATH, OUTPUT_PATH,REPO_PATH)
-
-    detection_path = generate_savedsearches_conf(objects["detections"], objects["deployments"], TEMPLATE_PATH, OUTPUT_PATH)
-
-    # story_path = generate_analytic_story_conf(objects["stories"], objects["detections"], TEMPLATE_PATH, OUTPUT_PATH)
-
-    use_case_lib_path = generate_use_case_library_conf(objects["stories"], objects["detections"], TEMPLATE_PATH, OUTPUT_PATH)
-
-    macros_path = generate_macros_conf(objects["macros"], objects["detections"], TEMPLATE_PATH, OUTPUT_PATH)
-
-    workbench_panels_objects = generate_workbench_panels(objects["detections"], objects["stories"], TEMPLATE_PATH, OUTPUT_PATH)
-
     # calculate deprecation totals
     deprecated = []
     for d in objects['detections']:
         if 'deprecated' in d:
             deprecated.append(d)
 
+    detection_path = ''
+    lookups_path = ''
+    lookups_files= ''
+    use_case_lib_path = ''
+    macros_path = ''
+    workbench_panels_objects = ''
+
+    if global_product == 'SSA':
+        detection_path = generate_ssa_yaml(objects["detections"], TEMPLATE_PATH, OUTPUT_PATH)
+        objects["macros"] = []
+    else:
+        detection_path = generate_savedsearches_conf(objects["detections"], objects["deployments"], TEMPLATE_PATH, OUTPUT_PATH)
+        lookups_path = generate_transforms_conf(objects["lookups"], TEMPLATE_PATH, OUTPUT_PATH)
+        lookups_path = generate_collections_conf(objects["lookups"], TEMPLATE_PATH, OUTPUT_PATH)
+        lookups_files = generate_lookup_files(objects["lookups"], TEMPLATE_PATH, OUTPUT_PATH,REPO_PATH)
+        use_case_lib_path = generate_use_case_library_conf(objects["stories"], objects["detections"], TEMPLATE_PATH, OUTPUT_PATH)
+        macros_path = generate_macros_conf(objects["macros"], objects["detections"], TEMPLATE_PATH, OUTPUT_PATH)
+        workbench_panels_objects = generate_workbench_panels(objects["detections"], objects["stories"], TEMPLATE_PATH, OUTPUT_PATH)
+
     if VERBOSE:
         print("{0} stories have been successfully written to {1}".format(len(objects["stories"]), use_case_lib_path))
         print("{0} detections have been successfully written to {1}".format(len(objects["detections"]), detection_path))
diff --git a/contentctl.py b/contentctl.py
index c1e889c83d..8fef798c79 100644
--- a/contentctl.py
+++ b/contentctl.py
@@ -103,16 +103,13 @@ def main(args):
 
     # validate arguments
     validate_parser.set_defaults(func=validate, epilog="""
-        Validates security manifest for correctness, adhering to spec and other common items.
-        VALIDATE DOES NOT PROCESS RESPONSES SPEC for the moment.""")
+        Validates security manifest for correctness, adhering to spec and other common items.""")
 
     # generate arguments
-    generate_parser.add_argument("-f", "--format", required=False, type=str, default="splunk_app",
-                                 help="Format of our deployment package, defaults to `splunk_app`.\n The deployment `splunk_app` runs on product Splunk Enterprise Security and Splunk Enterprise.")
     generate_parser.add_argument("-o", "--output", required=False, type=str, default="dist/escu",
                                      help="Path where to store the deployment package, defaults to `dist/escu`")
-    generate_parser.add_argument("--product", required=False, type=str, default="ESCU",
-                                 help="Type of package to create, choose between `ESCU`, or `SAAWS`. Defaults to `ESCU`")
+    generate_parser.add_argument("-p", "--product", required=False, type=str, default="ESCU",
+                                 help="Type of package to create, choose between `ESCU`, `DevSecOps`, `SAAWS`, or `SSA`. Defaults to `ESCU`")
     generate_parser.set_defaults(func=generate)
 
     # # parse them
diff --git a/dist/escu/default/analyticstories.conf b/dist/escu/default/analyticstories.conf
index b80e3077c5..158f10beb8 100644
--- a/dist/escu/default/analyticstories.conf
+++ b/dist/escu/default/analyticstories.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-10-28T22:30:10 UTC
+# On Date: 2021-11-01T18:33:22 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
diff --git a/dist/escu/default/collections.conf b/dist/escu/default/collections.conf
index 09a63bdee6..6a8b2ba871 100644
--- a/dist/escu/default/collections.conf
+++ b/dist/escu/default/collections.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-10-28T22:30:10 UTC
+# On Date: 2021-11-01T18:33:22 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
diff --git a/dist/escu/default/macros.conf b/dist/escu/default/macros.conf
index c6dec6c299..48e6e51fcd 100644
--- a/dist/escu/default/macros.conf
+++ b/dist/escu/default/macros.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-10-28T22:30:10 UTC
+# On Date: 2021-11-01T18:33:22 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
diff --git a/dist/escu/default/savedsearches.conf b/dist/escu/default/savedsearches.conf
index be738dd375..e60202142f 100644
--- a/dist/escu/default/savedsearches.conf
+++ b/dist/escu/default/savedsearches.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-10-28T22:30:10 UTC
+# On Date: 2021-11-01T18:33:22 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
diff --git a/dist/escu/default/transforms.conf b/dist/escu/default/transforms.conf
index 49af384249..082d546103 100644
--- a/dist/escu/default/transforms.conf
+++ b/dist/escu/default/transforms.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-10-28T22:30:10 UTC
+# On Date: 2021-11-01T18:33:22 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
diff --git a/dist/saaws/default/analyticstories.conf b/dist/saaws/default/analyticstories.conf
index 87d25289ed..5d77956e9c 100644
--- a/dist/saaws/default/analyticstories.conf
+++ b/dist/saaws/default/analyticstories.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-10-28T22:30:45 UTC
+# On Date: 2021-11-01T18:33:43 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -26,7 +26,7 @@ version = 2
 references = ["https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Appendix_NACLs.html", "https://aws.amazon.com/blogs/security/how-to-help-prepare-for-ddos-attacks-by-reducing-your-attack-surface/"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}]
 spec_version = 3
-searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - AWS Network Access Control List Created with All Open Ports - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"]
+searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - AWS Network Access Control List Created with All Open Ports - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"]
 description = Monitor your AWS network infrastructure for bad configurations and malicious activity. Investigative searches help you probe deeper, when the facts warrant it.
 narrative = AWS CloudTrail is an AWS service that helps you enable governance, compliance, and operational/risk auditing of your AWS account. Actions taken by a user, role, or an AWS service are recorded as events in CloudTrail. It is crucial for a company to monitor events and actions taken in the AWS Management Console, AWS Command Line Interface, and AWS SDKs and APIs to ensure that your servers are not vulnerable to attacks. This analytic story contains detection searches that leverage CloudTrail logs from AWS to check for bad configurations and malicious activity in your AWS network access controls.
 
@@ -37,7 +37,7 @@ version = 1
 references = ["https://aws.amazon.com/security-hub/features/"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}]
 spec_version = 3
-searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task"]
+searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task"]
 description = This story is focused around detecting Security Hub alerts generated from AWS
 narrative = AWS Security Hub collects and consolidates findings from AWS security services enabled in your environment, such as intrusion detection findings from Amazon GuardDuty, vulnerability scans from Amazon Inspector, S3 bucket policy findings from Amazon Macie, publicly accessible and cross-account resources from IAM Access Analyzer, and resources lacking WAF coverage from AWS Firewall Manager.
 
@@ -48,7 +48,7 @@ version = 1
 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}]
 spec_version = 3
-searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule", "ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"]
+searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule", "ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule", "ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"]
 description = Monitor your cloud compute instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or compute instances started by previously unseen users are just a few examples of potentially malicious behavior.
 narrative = Cryptomining is an intentionally difficult, resource-intensive business. Its complexity was designed into the process to ensure that the number of blocks mined each day would remain steady. So, it's par for the course that ambitious, but unscrupulous, miners make amassing the computing power of large enterprises--a practice known as cryptojacking--a top priority. \
 Cryptojacking has attracted an increasing amount of media attention since its explosion in popularity in the fall of 2017. The attacks have moved from in-browser exploits and mobile phones to enterprise cloud services, such as Amazon Web Services (AWS), Google Cloud Platform (GCP), and Azure. It's difficult to determine exactly how widespread the practice has become, since bad actors continually evolve their ability to escape detection, including employing unlisted endpoints, moderating their CPU usage, and hiding the mining pool's IP address behind a free CDN. \
@@ -106,7 +106,7 @@ version = 2
 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://www.tripwire.com/state-of-security/security-data-protection/cloud/public-aws-s3-buckets-writable/"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}]
 spec_version = 3
-searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - Detect New Open S3 Buckets over AWS CLI - Rule", "ESCU - Detect New Open S3 buckets - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS S3 Bucket details via bucketName - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"]
+searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - Detect New Open S3 Buckets over AWS CLI - Rule", "ESCU - Detect New Open S3 buckets - Rule", "ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS S3 Bucket details via bucketName - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"]
 description = Use the searches in this Analytic Story to monitor your AWS S3 buckets for evidence of anomalous activity and suspicious behaviors, such as detecting open S3 buckets and buckets being accessed from a new IP. The contextual and investigative searches will give you more information, when required.
 narrative = As cloud computing has exploded, so has the number of creative attacks on virtual environments. And as the number-two cloud-service provider, Amazon Web Services (AWS) has certainly had its share.\
 Amazon's "shared responsibility" model dictates that the company has responsibility for the environment outside of the VM and the customer is responsible for the security inside of the S3 container. As such, it's important to stay vigilant for activities that may belie suspicious behavior inside of your environment.\
@@ -119,7 +119,7 @@ version = 1
 references = ["https://aws.amazon.com/blogs/security/aws-cloudtrail-now-tracks-cross-account-activity-to-its-origin/", "https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}]
 spec_version = 3
-searches = ["ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule", "ESCU - Detect AWS Console Login by New User - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - Investigate AWS User Activities by user field - Response Task"]
+searches = ["ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule", "ESCU - Detect AWS Console Login by New User - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule", "ESCU - Investigate AWS User Activities by user field - Response Task"]
 description = Monitor your cloud authentication events. Searches within this Analytic Story leverage the recent cloud updates to the Authentication data model to help you stay aware of and investigate suspicious login activity. 
 narrative = It is important to monitor and control who has access to your cloud infrastructure. Detecting suspicious logins will provide good starting points for investigations. Abusive behaviors caused by compromised credentials can lead to direct monetary costs, as you will be billed for any compute activity whether legitimate or otherwise.\
 This Analytic Story has data model versions of cloud searches leveraging Authentication data, including those looking for suspicious login activity, and cross-account activity for AWS.
@@ -131,7 +131,7 @@ version = 1
 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}]
 spec_version = 3
-searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"]
+searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"]
 description = Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment.
 narrative = Monitoring your cloud infrastructure logs allows you enable governance, compliance, and risk auditing. It is crucial for a company to monitor events and actions taken in the their cloud environments to ensure that your instances are not vulnerable to attacks. This Analytic Story identifies suspicious activities in your cloud compute instances and helps you respond and investigate those activities.
 
@@ -163,6 +163,26 @@ In addition to compromising the security of your data, when bad actors leverage
 
 ### DETECTIONS ###
 
+[savedsearch://ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule]
+type = detection
+asset_type = AWS Instance
+confidence = medium
+explanation = This search will detect a spike in the number of API calls made to your cloud infrastructure environment by a user.
+how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Infrastructure API Calls Per User` to create the probability density function.
+annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.CM", "PR.AC"]}
+known_false_positives = 
+providing_technologies = []
+
+[savedsearch://ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule]
+type = detection
+asset_type = AWS Instance
+confidence = medium
+explanation = This search will detect a spike in the number of API calls made to your cloud infrastructure environment about security groups by a user.
+how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Security Group API Calls Per User` to create the probability density function model.
+annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.CM", "PR.AC"]}
+known_false_positives = 
+providing_technologies = []
+
 [savedsearch://ESCU - AWS Create Policy Version to allow all resources - Rule]
 type = detection
 asset_type = AWS Account
@@ -343,46 +363,6 @@ annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives
 known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created keys for another user.
 providing_technologies = []
 
-[savedsearch://ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule]
-type = detection
-asset_type = AWS Instance
-confidence = medium
-explanation = This search will detect a spike in the number of API calls made to your cloud infrastructure environment by a user.
-how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Infrastructure API Calls Per User` to create the probability density function.
-annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.CM", "PR.AC"]}
-known_false_positives = 
-providing_technologies = []
-
-[savedsearch://ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule]
-type = detection
-asset_type = Cloud Instance
-confidence = medium
-explanation = This search finds for the number successfully destroyed cloud instances for every 4 hour block. This is split up between weekdays and the weekend. It then applies the probability densitiy model previously created and alerts on any outliers.
-how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Instances Destroyed` to create the probability density function.
-annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.AE"]}
-known_false_positives = Many service accounts configured within a cloud infrastructure are known to exhibit this behavior. Please adjust the threshold values and filter out service accounts from the output. Always verify if this search alerted on a human user.
-providing_technologies = []
-
-[savedsearch://ESCU - Abnormally High Number Of Cloud Instances Launched - Rule]
-type = detection
-asset_type = Cloud Instance
-confidence = medium
-explanation = This search finds for the number successfully created cloud instances for every 4 hour block. This is split up between weekdays and the weekend. It then applies the probability densitiy model previously created and alerts on any outliers.
-how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Instances Launched` to create the probability density function.
-annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.AE"]}
-known_false_positives = Many service accounts configured within an AWS infrastructure are known to exhibit this behavior. Please adjust the threshold values and filter out service accounts from the output. Always verify if this search alerted on a human user.
-providing_technologies = []
-
-[savedsearch://ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule]
-type = detection
-asset_type = AWS Instance
-confidence = medium
-explanation = This search will detect a spike in the number of API calls made to your cloud infrastructure environment about security groups by a user.
-how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Security Group API Calls Per User` to create the probability density function model.
-annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.CM", "PR.AC"]}
-known_false_positives = 
-providing_technologies = []
-
 [savedsearch://ESCU - Cloud API Calls From Previously Unseen User Roles - Rule]
 type = detection
 asset_type = AWS Instance
@@ -527,16 +507,6 @@ annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives
 known_false_positives = When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate.
 providing_technologies = []
 
-[savedsearch://ESCU - Detect New Open S3 Buckets over AWS CLI - Rule]
-type = detection
-asset_type = S3 Bucket
-confidence = medium
-explanation = This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket over the aws cli.
-how_to_implement = 
-annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
-known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the "All Users" group.
-providing_technologies = []
-
 [savedsearch://ESCU - Detect New Open S3 buckets - Rule]
 type = detection
 asset_type = S3 Bucket
@@ -547,14 +517,14 @@ annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives
 known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the "All Users" group.
 providing_technologies = []
 
-[savedsearch://ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule]
+[savedsearch://ESCU - Detect New Open S3 Buckets over AWS CLI - Rule]
 type = detection
-asset_type = AWS Instance
+asset_type = S3 Bucket
 confidence = medium
-explanation = This search looks for a spike in number of of AWS security Hub alerts for an EC2 instance in 4 hours intervals
-how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Security Hub inputs. The threshold_value should be tuned to your environment and schedule these searches according to the bucket span interval.
-annotations = {"cis20": ["CIS 13"], "nist": ["DE.DP"]}
-known_false_positives = None
+explanation = This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket over the aws cli.
+how_to_implement = 
+annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
+known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the "All Users" group.
 providing_technologies = []
 
 [savedsearch://ESCU - Detect shared ec2 snapshot - Rule]
@@ -567,6 +537,16 @@ annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives
 known_false_positives = It is possible that an AWS admin has legitimately shared a snapshot with others for  a specific purpose.
 providing_technologies = []
 
+[savedsearch://ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule]
+type = detection
+asset_type = AWS Instance
+confidence = medium
+explanation = This search looks for a spike in number of of AWS security Hub alerts for an EC2 instance in 4 hours intervals
+how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Security Hub inputs. The threshold_value should be tuned to your environment and schedule these searches according to the bucket span interval.
+annotations = {"cis20": ["CIS 13"], "nist": ["DE.DP"]}
+known_false_positives = None
+providing_technologies = []
+
 [savedsearch://ESCU - O365 Add App Role Assignment Grant User - Rule]
 type = detection
 asset_type = Office 365
@@ -677,10 +657,38 @@ annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives
 known_false_positives = unknown
 providing_technologies = []
 
+[savedsearch://ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule]
+type = detection
+asset_type = Cloud Instance
+confidence = medium
+explanation = This search finds for the number successfully destroyed cloud instances for every 4 hour block. This is split up between weekdays and the weekend. It then applies the probability densitiy model previously created and alerts on any outliers.
+how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Instances Destroyed` to create the probability density function.
+annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.AE"]}
+known_false_positives = Many service accounts configured within a cloud infrastructure are known to exhibit this behavior. Please adjust the threshold values and filter out service accounts from the output. Always verify if this search alerted on a human user.
+providing_technologies = []
+
+[savedsearch://ESCU - Abnormally High Number Of Cloud Instances Launched - Rule]
+type = detection
+asset_type = Cloud Instance
+confidence = medium
+explanation = This search finds for the number successfully created cloud instances for every 4 hour block. This is split up between weekdays and the weekend. It then applies the probability densitiy model previously created and alerts on any outliers.
+how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Instances Launched` to create the probability density function.
+annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.AE"]}
+known_false_positives = Many service accounts configured within an AWS infrastructure are known to exhibit this behavior. Please adjust the threshold values and filter out service accounts from the output. Always verify if this search alerted on a human user.
+providing_technologies = []
+
 ### END DETECTIONS ###
 
 ### RESPONSE TASKS ###
 
+[savedsearch://ESCU - Amazon EKS Kubernetes activity by src ip - Response Task]
+type = investigation
+explanation = none
+how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Cloud Watch EKS inputs.
+known_false_positives = not defined
+earliest_time_offset = 14400
+latest_time_offset = 0
+
 [savedsearch://ESCU - AWS Investigate Security Hub alerts by dest - Response Task]
 type = investigation
 explanation = none
@@ -689,7 +697,7 @@ known_false_positives = not defined
 earliest_time_offset = 14400
 latest_time_offset = 0
 
-[savedsearch://ESCU - AWS Investigate User Activities By ARN - Response Task]
+[savedsearch://ESCU - AWS Investigate User Activities By AccessKeyId - Response Task]
 type = investigation
 explanation = none
 how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs.
@@ -697,7 +705,7 @@ known_false_positives = not defined
 earliest_time_offset = 14400
 latest_time_offset = 0
 
-[savedsearch://ESCU - AWS Investigate User Activities By AccessKeyId - Response Task]
+[savedsearch://ESCU - AWS Investigate User Activities By ARN - Response Task]
 type = investigation
 explanation = none
 how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs.
@@ -729,14 +737,6 @@ known_false_positives = not defined
 earliest_time_offset = 14400
 latest_time_offset = 0
 
-[savedsearch://ESCU - Amazon EKS Kubernetes activity by src ip - Response Task]
-type = investigation
-explanation = none
-how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Cloud Watch EKS inputs.
-known_false_positives = not defined
-earliest_time_offset = 14400
-latest_time_offset = 0
-
 [savedsearch://ESCU - Get All AWS Activity From City - Response Task]
 type = investigation
 explanation = none
@@ -785,14 +785,6 @@ known_false_positives = not defined
 earliest_time_offset = 14400
 latest_time_offset = 0
 
-[savedsearch://ESCU - Investigate AWS User Activities by user field - Response Task]
-type = investigation
-explanation = none
-how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs.
-known_false_positives = not defined
-earliest_time_offset = 14400
-latest_time_offset = 0
-
 [savedsearch://ESCU - Investigate AWS activities via region name - Response Task]
 type = investigation
 explanation = none
@@ -801,4 +793,12 @@ known_false_positives = not defined
 earliest_time_offset = 14400
 latest_time_offset = 0
 
+[savedsearch://ESCU - Investigate AWS User Activities by user field - Response Task]
+type = investigation
+explanation = none
+how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs.
+known_false_positives = not defined
+earliest_time_offset = 14400
+latest_time_offset = 0
+
 ### END RESPONSE TASKS ###
diff --git a/dist/saaws/default/collections.conf b/dist/saaws/default/collections.conf
index 5c6a29da87..0611bc763a 100644
--- a/dist/saaws/default/collections.conf
+++ b/dist/saaws/default/collections.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-10-28T22:30:45 UTC
+# On Date: 2021-11-01T18:33:43 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
diff --git a/dist/saaws/default/macros.conf b/dist/saaws/default/macros.conf
index 9bd6ecc18f..129508c1ee 100644
--- a/dist/saaws/default/macros.conf
+++ b/dist/saaws/default/macros.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-10-28T22:30:45 UTC
+# On Date: 2021-11-01T18:33:43 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -483,6 +483,18 @@ description = customer specific splunk configurations(eg- index, source, sourcet
 definition = index=zeek sourcetype="zeek:ssl:json"
 description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
 
+[abnormally_high_number_of_cloud_infrastructure_api_calls_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[abnormally_high_number_of_cloud_security_group_api_calls_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[amazon_eks_kubernetes_activity_by_src_ip_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [aws_create_policy_version_to_allow_all_resources_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
@@ -535,15 +547,11 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
-[aws_investigate_user_activities_by_arn_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
 [aws_investigate_user_activities_by_accesskeyid_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
-[aws_network_acl_details_from_id_filter]
+[aws_investigate_user_activities_by_arn_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
@@ -555,6 +563,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
+[aws_network_acl_details_from_id_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [aws_network_interface_details_via_resourceid_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
@@ -579,26 +591,6 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
-[abnormally_high_number_of_cloud_infrastructure_api_calls_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[abnormally_high_number_of_cloud_instances_destroyed_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[abnormally_high_number_of_cloud_instances_launched_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[abnormally_high_number_of_cloud_security_group_api_calls_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
-[amazon_eks_kubernetes_activity_by_src_ip_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
 [baseline_of_cloud_infrastructure_api_calls_per_user_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
@@ -671,15 +663,11 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
-[detect_new_open_s3_buckets_over_aws_cli_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
 [detect_new_open_s3_buckets_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
-[detect_spike_in_aws_security_hub_alerts_for_ec2_instance_filter]
+[detect_new_open_s3_buckets_over_aws_cli_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
@@ -687,6 +675,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
+[detect_spike_in_aws_security_hub_alerts_for_ec2_instance_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [get_all_aws_activity_from_city_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
@@ -711,11 +703,11 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
-[investigate_aws_user_activities_by_user_field_filter]
+[investigate_aws_activities_via_region_name_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
-[investigate_aws_activities_via_region_name_filter]
+[investigate_aws_user_activities_by_user_field_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
@@ -827,11 +819,19 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
-[previously_seen_users_in_cloudtrail___update_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives. 
-
 [previously_seen_users_in_cloudtrail___initial_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
+[previously_seen_users_in_cloudtrail___update_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[abnormally_high_number_of_cloud_instances_destroyed_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[abnormally_high_number_of_cloud_instances_launched_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
diff --git a/dist/saaws/default/savedsearches.conf b/dist/saaws/default/savedsearches.conf
index 80ae9e8b43..0b5c608751 100644
--- a/dist/saaws/default/savedsearches.conf
+++ b/dist/saaws/default/savedsearches.conf
@@ -1,12 +1,90 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-10-28T22:30:45 UTC
+# On Date: 2021-11-01T18:33:43 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
 
 ### ESCU DETECTIONS ###
 
+[ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = This search will detect a spike in the number of API calls made to your cloud infrastructure environment by a user.
+action.escu.mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.CM", "PR.AC"]}
+action.escu.data_models = ["Change"]
+action.escu.eli5 = This search will detect a spike in the number of API calls made to your cloud infrastructure environment by a user.
+action.escu.how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Infrastructure API Calls Per User` to create the probability density function.
+action.escu.known_false_positives = 
+action.escu.creation_date = 2020-09-07
+action.escu.modification_date = 2020-09-07
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = []
+action.escu.analytic_story = ["Suspicious Cloud User Activities"]
+action.risk = 1
+action.risk.param._risk_message = user $user$ has made $api_calls$ api calls, violating the dynamic threshold of $expected_upper_threshold$ with the following command $command$.
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15}]
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud User Activities"], "cis20": ["CIS 16"], "confidence": 50, "context": ["Source:Cloud Data", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.CM", "PR.AC"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = false
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats count as api_calls values(All_Changes.command) as command from datamodel=Change where All_Changes.user!=unknown All_Changes.status=success by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")` | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | join user HourOfDay isWeekend [ summary cloud_excessive_api_calls_v1] | where cardinality >=16 | apply cloud_excessive_api_calls_v1 threshold=0.005 | rename "IsOutlier(api_calls)" as isOutlier | where isOutlier=1 | eval expected_upper_threshold = mvindex(split(mvindex(BoundaryRanges, -1), ":"), 0) | where api_calls > expected_upper_threshold | eval distance_from_threshold = api_calls - expected_upper_threshold | table _time, user, command, api_calls, expected_upper_threshold, distance_from_threshold | `abnormally_high_number_of_cloud_infrastructure_api_calls_filter`
+
+[ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = This search will detect a spike in the number of API calls made to your cloud infrastructure environment about security groups by a user.
+action.escu.mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.CM", "PR.AC"]}
+action.escu.data_models = ["Change"]
+action.escu.eli5 = This search will detect a spike in the number of API calls made to your cloud infrastructure environment about security groups by a user.
+action.escu.how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Security Group API Calls Per User` to create the probability density function model.
+action.escu.known_false_positives = 
+action.escu.creation_date = 2020-09-07
+action.escu.modification_date = 2020-09-07
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = []
+action.escu.analytic_story = ["Suspicious Cloud User Activities"]
+action.risk = 1
+action.risk.param._risk_message = user $user$ has made $api_calls$ api calls related to security groups, violating the dynamic threshold of $expected_upper_threshold$ with the following command $command$.
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15}]
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud User Activities"], "cis20": ["CIS 16"], "confidence": 50, "context": ["Source:Cloud Data", "Scope:Inbound", "Outcome:Allowed", "Stage:Execution", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.CM", "PR.AC"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = false
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats count as security_group_api_calls values(All_Changes.command) as command from datamodel=Change where All_Changes.object_category=firewall AND All_Changes.status=success by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")` | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | join user HourOfDay isWeekend [ summary cloud_excessive_security_group_api_calls_v1] | where cardinality >=16 | apply cloud_excessive_security_group_api_calls_v1 threshold=0.005 | rename "IsOutlier(security_group_api_calls)" as isOutlier | where isOutlier=1 | eval expected_upper_threshold = mvindex(split(mvindex(BoundaryRanges, -1), ":"), 0) | where security_group_api_calls > expected_upper_threshold | eval distance_from_threshold = security_group_api_calls - expected_upper_threshold | table _time, user, command, security_group_api_calls, expected_upper_threshold, distance_from_threshold | `abnormally_high_number_of_cloud_security_group_api_calls_filter`
+
 [ESCU - AWS Create Policy Version to allow all resources - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -709,162 +787,6 @@ realtime_schedule = 0
 is_visible = false
 search = `cloudtrail` eventName = UpdateLoginProfile userAgent !=console.amazonaws.com errorCode = success| search userIdentity.userName!=requestParameters.userName  |  stats count min(_time) as firstTime max(_time) as lastTime  by requestParameters.userName src eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.userName user_arn | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|`aws_updateloginprofile_filter`
 
-[ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule]
-action.escu = 0
-action.escu.enabled = 1
-description = This search will detect a spike in the number of API calls made to your cloud infrastructure environment by a user.
-action.escu.mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.CM", "PR.AC"]}
-action.escu.data_models = ["Change"]
-action.escu.eli5 = This search will detect a spike in the number of API calls made to your cloud infrastructure environment by a user.
-action.escu.how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Infrastructure API Calls Per User` to create the probability density function.
-action.escu.known_false_positives = 
-action.escu.creation_date = 2020-09-07
-action.escu.modification_date = 2020-09-07
-action.escu.confidence = high
-action.escu.full_search_name = ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule
-action.escu.search_type = detection
-action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
-action.escu.analytic_story = ["Suspicious Cloud User Activities"]
-action.risk = 1
-action.risk.param._risk_message = user $user$ has made $api_calls$ api calls, violating the dynamic threshold of $expected_upper_threshold$ with the following command $command$.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15}]
-action.risk.param.verbose = 0
-cron_schedule = 0 * * * *
-dispatch.earliest_time = -70m@m
-dispatch.latest_time = -10m@m
-action.correlationsearch.enabled = 1
-action.correlationsearch.label = ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud User Activities"], "cis20": ["CIS 16"], "confidence": 50, "context": ["Source:Cloud Data", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.CM", "PR.AC"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]}
-schedule_window = auto
-alert.digest_mode = 1
-disabled = false
-enableSched = 1
-allow_skew = 100%
-counttype = number of events
-relation = greater than
-quantity = 0
-realtime_schedule = 0
-is_visible = false
-search = | tstats count as api_calls values(All_Changes.command) as command from datamodel=Change where All_Changes.user!=unknown All_Changes.status=success by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")` | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | join user HourOfDay isWeekend [ summary cloud_excessive_api_calls_v1] | where cardinality >=16 | apply cloud_excessive_api_calls_v1 threshold=0.005 | rename "IsOutlier(api_calls)" as isOutlier | where isOutlier=1 | eval expected_upper_threshold = mvindex(split(mvindex(BoundaryRanges, -1), ":"), 0) | where api_calls > expected_upper_threshold | eval distance_from_threshold = api_calls - expected_upper_threshold | table _time, user, command, api_calls, expected_upper_threshold, distance_from_threshold | `abnormally_high_number_of_cloud_infrastructure_api_calls_filter`
-
-[ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule]
-action.escu = 0
-action.escu.enabled = 1
-description = This search finds for the number successfully destroyed cloud instances for every 4 hour block. This is split up between weekdays and the weekend. It then applies the probability densitiy model previously created and alerts on any outliers.
-action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.AE"]}
-action.escu.data_models = ["Change"]
-action.escu.eli5 = This search finds for the number successfully destroyed cloud instances for every 4 hour block. This is split up between weekdays and the weekend. It then applies the probability densitiy model previously created and alerts on any outliers.
-action.escu.how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Instances Destroyed` to create the probability density function.
-action.escu.known_false_positives = Many service accounts configured within a cloud infrastructure are known to exhibit this behavior. Please adjust the threshold values and filter out service accounts from the output. Always verify if this search alerted on a human user.
-action.escu.creation_date = 2020-08-21
-action.escu.modification_date = 2020-08-21
-action.escu.confidence = high
-action.escu.full_search_name = ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule
-action.escu.search_type = detection
-action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
-action.escu.analytic_story = ["Suspicious Cloud Instance Activities"]
-action.risk = 1
-action.risk.param._risk_message = 
-action.risk.param._risk = []
-action.risk.param.verbose = 0
-cron_schedule = 0 * * * *
-dispatch.earliest_time = -70m@m
-dispatch.latest_time = -10m@m
-action.correlationsearch.enabled = 1
-action.correlationsearch.label = ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Instance Activities"], "cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.AE"]}
-schedule_window = auto
-alert.digest_mode = 1
-disabled = false
-enableSched = 1
-allow_skew = 100%
-counttype = number of events
-relation = greater than
-quantity = 0
-realtime_schedule = 0
-is_visible = false
-search = | tstats count as instances_destroyed values(All_Changes.object_id) as object_id from datamodel=Change where All_Changes.action=deleted AND All_Changes.status=success AND All_Changes.object_category=instance by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")` | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | join HourOfDay isWeekend [summary cloud_excessive_instances_destroyed_v1] | where cardinality >=16 | apply cloud_excessive_instances_destroyed_v1 threshold=0.005 | rename "IsOutlier(instances_destroyed)" as isOutlier | where isOutlier=1 | eval expected_upper_threshold = mvindex(split(mvindex(BoundaryRanges, -1), ":"), 0) | eval distance_from_threshold = instances_destroyed - expected_upper_threshold | table _time, user, instances_destroyed, expected_upper_threshold, distance_from_threshold, object_id | `abnormally_high_number_of_cloud_instances_destroyed_filter`
-
-[ESCU - Abnormally High Number Of Cloud Instances Launched - Rule]
-action.escu = 0
-action.escu.enabled = 1
-description = This search finds for the number successfully created cloud instances for every 4 hour block. This is split up between weekdays and the weekend. It then applies the probability densitiy model previously created and alerts on any outliers.
-action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.AE"]}
-action.escu.data_models = ["Change"]
-action.escu.eli5 = This search finds for the number successfully created cloud instances for every 4 hour block. This is split up between weekdays and the weekend. It then applies the probability densitiy model previously created and alerts on any outliers.
-action.escu.how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Instances Launched` to create the probability density function.
-action.escu.known_false_positives = Many service accounts configured within an AWS infrastructure are known to exhibit this behavior. Please adjust the threshold values and filter out service accounts from the output. Always verify if this search alerted on a human user.
-action.escu.creation_date = 2020-08-21
-action.escu.modification_date = 2020-08-21
-action.escu.confidence = high
-action.escu.full_search_name = ESCU - Abnormally High Number Of Cloud Instances Launched - Rule
-action.escu.search_type = detection
-action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
-action.escu.analytic_story = ["Cloud Cryptomining", "Suspicious Cloud Instance Activities"]
-action.risk = 1
-action.risk.param._risk_message = 
-action.risk.param._risk = []
-action.risk.param.verbose = 0
-cron_schedule = 0 * * * *
-dispatch.earliest_time = -70m@m
-dispatch.latest_time = -10m@m
-action.correlationsearch.enabled = 1
-action.correlationsearch.label = ESCU - Abnormally High Number Of Cloud Instances Launched - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining", "Suspicious Cloud Instance Activities"], "cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.AE"]}
-schedule_window = auto
-alert.digest_mode = 1
-disabled = false
-enableSched = 1
-allow_skew = 100%
-counttype = number of events
-relation = greater than
-quantity = 0
-realtime_schedule = 0
-is_visible = false
-search = | tstats count as instances_launched values(All_Changes.object_id) as object_id from datamodel=Change where (All_Changes.action=created) AND All_Changes.status=success AND All_Changes.object_category=instance by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")` | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | join HourOfDay isWeekend [summary cloud_excessive_instances_created_v1] | where cardinality >=16 | apply cloud_excessive_instances_created_v1 threshold=0.005 | rename "IsOutlier(instances_launched)" as isOutlier | where isOutlier=1 | eval expected_upper_threshold = mvindex(split(mvindex(BoundaryRanges, -1), ":"), 0) | eval distance_from_threshold = instances_launched - expected_upper_threshold | table _time, user, instances_launched, expected_upper_threshold, distance_from_threshold, object_id | `abnormally_high_number_of_cloud_instances_launched_filter`
-
-[ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule]
-action.escu = 0
-action.escu.enabled = 1
-description = This search will detect a spike in the number of API calls made to your cloud infrastructure environment about security groups by a user.
-action.escu.mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.CM", "PR.AC"]}
-action.escu.data_models = ["Change"]
-action.escu.eli5 = This search will detect a spike in the number of API calls made to your cloud infrastructure environment about security groups by a user.
-action.escu.how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Security Group API Calls Per User` to create the probability density function model.
-action.escu.known_false_positives = 
-action.escu.creation_date = 2020-09-07
-action.escu.modification_date = 2020-09-07
-action.escu.confidence = high
-action.escu.full_search_name = ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule
-action.escu.search_type = detection
-action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
-action.escu.analytic_story = ["Suspicious Cloud User Activities"]
-action.risk = 1
-action.risk.param._risk_message = user $user$ has made $api_calls$ api calls related to security groups, violating the dynamic threshold of $expected_upper_threshold$ with the following command $command$.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15}]
-action.risk.param.verbose = 0
-cron_schedule = 0 * * * *
-dispatch.earliest_time = -70m@m
-dispatch.latest_time = -10m@m
-action.correlationsearch.enabled = 1
-action.correlationsearch.label = ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud User Activities"], "cis20": ["CIS 16"], "confidence": 50, "context": ["Source:Cloud Data", "Scope:Inbound", "Outcome:Allowed", "Stage:Execution", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.CM", "PR.AC"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]}
-schedule_window = auto
-alert.digest_mode = 1
-disabled = false
-enableSched = 1
-allow_skew = 100%
-counttype = number of events
-relation = greater than
-quantity = 0
-realtime_schedule = 0
-is_visible = false
-search = | tstats count as security_group_api_calls values(All_Changes.command) as command from datamodel=Change where All_Changes.object_category=firewall AND All_Changes.status=success by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")` | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | join user HourOfDay isWeekend [ summary cloud_excessive_security_group_api_calls_v1] | where cardinality >=16 | apply cloud_excessive_security_group_api_calls_v1 threshold=0.005 | rename "IsOutlier(security_group_api_calls)" as isOutlier | where isOutlier=1 | eval expected_upper_threshold = mvindex(split(mvindex(BoundaryRanges, -1), ":"), 0) | where security_group_api_calls > expected_upper_threshold | eval distance_from_threshold = security_group_api_calls - expected_upper_threshold | table _time, user, command, security_group_api_calls, expected_upper_threshold, distance_from_threshold | `abnormally_high_number_of_cloud_security_group_api_calls_filter`
-
 [ESCU - Cloud API Calls From Previously Unseen User Roles - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -1415,45 +1337,6 @@ realtime_schedule = 0
 is_visible = false
 search = | tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | `drop_dm_object_name(Authentication)` | table firstTime lastTime user Region | join user  type=outer [| inputlookup previously_seen_users_console_logins | stats earliest(firstTime) AS earliestseen by user Region | fields earliestseen user Region] | eval userRegion=if(firstTime >= relative_time(now(), "-24h@h"), "New Region","Previously Seen Region") | eval userStatus=if(earliestseen >= relative_time(now(), "-24h@h") OR isnull(earliestseen), "New User","Old User") | where userRegion = "New Region" AND userStatus != "Old User" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | table firstTime lastTime user Region  userStatus userRegion  | `detect_aws_console_login_by_user_from_new_region_filter`
 
-[ESCU - Detect New Open S3 Buckets over AWS CLI - Rule]
-action.escu = 0
-action.escu.enabled = 1
-description = This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket over the aws cli.
-action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
-action.escu.data_models = []
-action.escu.eli5 = This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket over the aws cli.
-action.escu.how_to_implement = 
-action.escu.known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the "All Users" group.
-action.escu.creation_date = 2021-07-19
-action.escu.modification_date = 2021-07-19
-action.escu.confidence = high
-action.escu.full_search_name = ESCU - Detect New Open S3 Buckets over AWS CLI - Rule
-action.escu.search_type = detection
-action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
-action.escu.analytic_story = ["Suspicious AWS S3 Activities"]
-action.risk = 1
-action.risk.param._risk_message = User $userIdentity.userName$ has created an open/public bucket $bucketName$ using AWS CLI with the following permissions - $requestParameters.accessControlList.x-amz-grant-read$ $requestParameters.accessControlList.x-amz-grant-read-acp$ $requestParameters.accessControlList.x-amz-grant-write$ $requestParameters.accessControlList.x-amz-grant-write-acp$ $requestParameters.accessControlList.x-amz-grant-full-control$
-action.risk.param._risk = [{"risk_object_field": "userIdentity.userName", "risk_object_type": "user", "risk_score": 48}, {"threat_object_field": "bucketName", "threat_object_type": "other"}]
-action.risk.param.verbose = 0
-cron_schedule = 0 * * * *
-dispatch.earliest_time = -70m@m
-dispatch.latest_time = -10m@m
-action.correlationsearch.enabled = 1
-action.correlationsearch.label = ESCU - Detect New Open S3 Buckets over AWS CLI - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS S3 Activities"], "cis20": ["CIS 13"], "confidence": 80, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 60, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "userIdentity.userName", "role": ["Attacker"], "type": "User"}, {"name": "bucketName", "role": ["Victim"], "type": "Other"}]}
-schedule_window = auto
-alert.digest_mode = 1
-disabled = false
-enableSched = 1
-allow_skew = 100%
-counttype = number of events
-relation = greater than
-quantity = 0
-realtime_schedule = 0
-is_visible = false
-search = `cloudtrail` eventSource="s3.amazonaws.com" (userAgent="[aws-cli*" OR userAgent=aws-cli* ) eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-full-control IN ("*AuthenticatedUsers","*AllUsers") | rename requestParameters.bucketName AS bucketName | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by userIdentity.userName userIdentity.principalId userAgent bucketName requestParameters.accessControlList.x-amz-grant-read requestParameters.accessControlList.x-amz-grant-read-acp requestParameters.accessControlList.x-amz-grant-write requestParameters.accessControlList.x-amz-grant-write-acp requestParameters.accessControlList.x-amz-grant-full-control | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_new_open_s3_buckets_over_aws_cli_filter` 
-
 [ESCU - Detect New Open S3 buckets - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -1493,33 +1376,33 @@ realtime_schedule = 0
 is_visible = false
 search = `cloudtrail` eventSource=s3.amazonaws.com eventName=PutBucketAcl | rex field=_raw "(?<json_field>{.+})" | spath input=json_field output=grantees path=requestParameters.AccessControlPolicy.AccessControlList.Grant{} | search grantees=* | mvexpand grantees | spath input=grantees output=uri path=Grantee.URI | spath input=grantees output=permission path=Permission | search uri IN ("http://acs.amazonaws.com/groups/global/AllUsers","http://acs.amazonaws.com/groups/global/AuthenticatedUsers") | search permission IN ("READ","READ_ACP","WRITE","WRITE_ACP","FULL_CONTROL") | rename requestParameters.bucketName AS bucketName | stats count min(_time) as firstTime max(_time) as lastTime by user_arn userIdentity.principalId userAgent uri permission bucketName | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_new_open_s3_buckets_filter` 
 
-[ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule]
+[ESCU - Detect New Open S3 Buckets over AWS CLI - Rule]
 action.escu = 0
 action.escu.enabled = 1
-description = This search looks for a spike in number of of AWS security Hub alerts for an EC2 instance in 4 hours intervals
-action.escu.mappings = {"cis20": ["CIS 13"], "nist": ["DE.DP"]}
+description = This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket over the aws cli.
+action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
 action.escu.data_models = []
-action.escu.eli5 = This search looks for a spike in number of of AWS security Hub alerts for an EC2 instance in 4 hours intervals
-action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Security Hub inputs. The threshold_value should be tuned to your environment and schedule these searches according to the bucket span interval.
-action.escu.known_false_positives = None
-action.escu.creation_date = 2021-01-26
-action.escu.modification_date = 2021-01-26
+action.escu.eli5 = This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket over the aws cli.
+action.escu.how_to_implement = 
+action.escu.known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the "All Users" group.
+action.escu.creation_date = 2021-07-19
+action.escu.modification_date = 2021-07-19
 action.escu.confidence = high
-action.escu.full_search_name = ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule
+action.escu.full_search_name = ESCU - Detect New Open S3 Buckets over AWS CLI - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = []
-action.escu.analytic_story = ["AWS Security Hub Alerts"]
+action.escu.analytic_story = ["Suspicious AWS S3 Activities"]
 action.risk = 1
-action.risk.param._risk_message = Spike in AWS security Hub alerts with title $Title$ for EC2 instance $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}]
+action.risk.param._risk_message = User $userIdentity.userName$ has created an open/public bucket $bucketName$ using AWS CLI with the following permissions - $requestParameters.accessControlList.x-amz-grant-read$ $requestParameters.accessControlList.x-amz-grant-read-acp$ $requestParameters.accessControlList.x-amz-grant-write$ $requestParameters.accessControlList.x-amz-grant-write-acp$ $requestParameters.accessControlList.x-amz-grant-full-control$
+action.risk.param._risk = [{"risk_object_field": "userIdentity.userName", "risk_object_type": "user", "risk_score": 48}, {"threat_object_field": "bucketName", "threat_object_type": "other"}]
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
-action.correlationsearch.label = ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule
-action.correlationsearch.annotations = {"analytic_story": ["AWS Security Hub Alerts"], "cis20": ["CIS 13"], "confidence": 50, "context": ["Source:Cloud Data", "Stage:Execution"], "impact": 30, "nist": ["DE.DP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
+action.correlationsearch.label = ESCU - Detect New Open S3 Buckets over AWS CLI - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS S3 Activities"], "cis20": ["CIS 13"], "confidence": 80, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 60, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "userIdentity.userName", "role": ["Attacker"], "type": "User"}, {"name": "bucketName", "role": ["Victim"], "type": "Other"}]}
 schedule_window = auto
 alert.digest_mode = 1
 disabled = false
@@ -1530,7 +1413,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `aws_securityhub_finding` "Resources{}.Type"=AWSEC2Instance | bucket span=4h _time | stats count AS alerts values(Title) as Title values(Types{}) as Types values(vendor_account) as vendor_account values(vendor_region) as vendor_region values(severity) as severity by _time dest | eventstats avg(alerts) as total_alerts_avg, stdev(alerts) as total_alerts_stdev | eval threshold_value = 3 | eval isOutlier=if(alerts > total_alerts_avg+(total_alerts_stdev * threshold_value), 1, 0) | search isOutlier=1 | table _time dest alerts Title Types vendor_account vendor_region severity isOutlier total_alerts_avg | `detect_spike_in_aws_security_hub_alerts_for_ec2_instance_filter`
+search = `cloudtrail` eventSource="s3.amazonaws.com" (userAgent="[aws-cli*" OR userAgent=aws-cli* ) eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-full-control IN ("*AuthenticatedUsers","*AllUsers") | rename requestParameters.bucketName AS bucketName | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by userIdentity.userName userIdentity.principalId userAgent bucketName requestParameters.accessControlList.x-amz-grant-read requestParameters.accessControlList.x-amz-grant-read-acp requestParameters.accessControlList.x-amz-grant-write requestParameters.accessControlList.x-amz-grant-write-acp requestParameters.accessControlList.x-amz-grant-full-control | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_new_open_s3_buckets_over_aws_cli_filter` 
 
 [ESCU - Detect shared ec2 snapshot - Rule]
 action.escu = 0
@@ -1571,6 +1454,45 @@ realtime_schedule = 0
 is_visible = false
 search = `cloudtrail` eventName=ModifySnapshotAttribute | rename requestParameters.createVolumePermission.add.items{}.userId as requested_account_id | search requested_account_id != NULL | eval match=if(requested_account_id==aws_account_id,"Match","No Match") | table _time user_arn src_ip requestParameters.attributeType requested_account_id aws_account_id match vendor_region user_agent | where match = "No Match" | `detect_shared_ec2_snapshot_filter` 
 
+[ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = This search looks for a spike in number of of AWS security Hub alerts for an EC2 instance in 4 hours intervals
+action.escu.mappings = {"cis20": ["CIS 13"], "nist": ["DE.DP"]}
+action.escu.data_models = []
+action.escu.eli5 = This search looks for a spike in number of of AWS security Hub alerts for an EC2 instance in 4 hours intervals
+action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Security Hub inputs. The threshold_value should be tuned to your environment and schedule these searches according to the bucket span interval.
+action.escu.known_false_positives = None
+action.escu.creation_date = 2021-01-26
+action.escu.modification_date = 2021-01-26
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = []
+action.escu.analytic_story = ["AWS Security Hub Alerts"]
+action.risk = 1
+action.risk.param._risk_message = Spike in AWS security Hub alerts with title $Title$ for EC2 instance $dest$
+action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}]
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule
+action.correlationsearch.annotations = {"analytic_story": ["AWS Security Hub Alerts"], "cis20": ["CIS 13"], "confidence": 50, "context": ["Source:Cloud Data", "Stage:Execution"], "impact": 30, "nist": ["DE.DP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = false
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `aws_securityhub_finding` "Resources{}.Type"=AWSEC2Instance | bucket span=4h _time | stats count AS alerts values(Title) as Title values(Types{}) as Types values(vendor_account) as vendor_account values(vendor_region) as vendor_region values(severity) as severity by _time dest | eventstats avg(alerts) as total_alerts_avg, stdev(alerts) as total_alerts_stdev | eval threshold_value = 3 | eval isOutlier=if(alerts > total_alerts_avg+(total_alerts_stdev * threshold_value), 1, 0) | search isOutlier=1 | table _time dest alerts Title Types vendor_account vendor_region severity isOutlier total_alerts_avg | `detect_spike_in_aws_security_hub_alerts_for_ec2_instance_filter`
+
 [ESCU - O365 Add App Role Assignment Grant User - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -2000,6 +1922,84 @@ realtime_schedule = 0
 is_visible = false
 search = `o365_management_activity` Operation=Set-Mailbox | spath input=Parameters | rename Identity AS src_user | search ForwardingSmtpAddress=* | stats dc(src_user) AS count_src_user earliest(_time) as firstTime latest(_time) as lastTime values(src_user) AS src_user values(user) AS user by ForwardingSmtpAddress | where count_src_user > 1 |`security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` |`o365_suspicious_user_email_forwarding_filter`
 
+[ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = This search finds for the number successfully destroyed cloud instances for every 4 hour block. This is split up between weekdays and the weekend. It then applies the probability densitiy model previously created and alerts on any outliers.
+action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.AE"]}
+action.escu.data_models = ["Change"]
+action.escu.eli5 = This search finds for the number successfully destroyed cloud instances for every 4 hour block. This is split up between weekdays and the weekend. It then applies the probability densitiy model previously created and alerts on any outliers.
+action.escu.how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Instances Destroyed` to create the probability density function.
+action.escu.known_false_positives = Many service accounts configured within a cloud infrastructure are known to exhibit this behavior. Please adjust the threshold values and filter out service accounts from the output. Always verify if this search alerted on a human user.
+action.escu.creation_date = 2020-08-21
+action.escu.modification_date = 2020-08-21
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = []
+action.escu.analytic_story = ["Suspicious Cloud Instance Activities"]
+action.risk = 1
+action.risk.param._risk_message = 
+action.risk.param._risk = []
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Instance Activities"], "cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.AE"]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = false
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats count as instances_destroyed values(All_Changes.object_id) as object_id from datamodel=Change where All_Changes.action=deleted AND All_Changes.status=success AND All_Changes.object_category=instance by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")` | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | join HourOfDay isWeekend [summary cloud_excessive_instances_destroyed_v1] | where cardinality >=16 | apply cloud_excessive_instances_destroyed_v1 threshold=0.005 | rename "IsOutlier(instances_destroyed)" as isOutlier | where isOutlier=1 | eval expected_upper_threshold = mvindex(split(mvindex(BoundaryRanges, -1), ":"), 0) | eval distance_from_threshold = instances_destroyed - expected_upper_threshold | table _time, user, instances_destroyed, expected_upper_threshold, distance_from_threshold, object_id | `abnormally_high_number_of_cloud_instances_destroyed_filter`
+
+[ESCU - Abnormally High Number Of Cloud Instances Launched - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = This search finds for the number successfully created cloud instances for every 4 hour block. This is split up between weekdays and the weekend. It then applies the probability densitiy model previously created and alerts on any outliers.
+action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.AE"]}
+action.escu.data_models = ["Change"]
+action.escu.eli5 = This search finds for the number successfully created cloud instances for every 4 hour block. This is split up between weekdays and the weekend. It then applies the probability densitiy model previously created and alerts on any outliers.
+action.escu.how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Instances Launched` to create the probability density function.
+action.escu.known_false_positives = Many service accounts configured within an AWS infrastructure are known to exhibit this behavior. Please adjust the threshold values and filter out service accounts from the output. Always verify if this search alerted on a human user.
+action.escu.creation_date = 2020-08-21
+action.escu.modification_date = 2020-08-21
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Abnormally High Number Of Cloud Instances Launched - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = []
+action.escu.analytic_story = ["Cloud Cryptomining", "Suspicious Cloud Instance Activities"]
+action.risk = 1
+action.risk.param._risk_message = 
+action.risk.param._risk = []
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Abnormally High Number Of Cloud Instances Launched - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining", "Suspicious Cloud Instance Activities"], "cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.AE"]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = false
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats count as instances_launched values(All_Changes.object_id) as object_id from datamodel=Change where (All_Changes.action=created) AND All_Changes.status=success AND All_Changes.object_category=instance by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")` | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | join HourOfDay isWeekend [summary cloud_excessive_instances_created_v1] | where cardinality >=16 | apply cloud_excessive_instances_created_v1 threshold=0.005 | rename "IsOutlier(instances_launched)" as isOutlier | where isOutlier=1 | eval expected_upper_threshold = mvindex(split(mvindex(BoundaryRanges, -1), ":"), 0) | eval distance_from_threshold = instances_launched - expected_upper_threshold | table _time, user, instances_launched, expected_upper_threshold, distance_from_threshold, object_id | `abnormally_high_number_of_cloud_instances_launched_filter`
+
 ### END ESCU DETECTIONS ###
 
 
@@ -2447,28 +2447,6 @@ disabled = false
 is_visible = false
 search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created by All_Changes.vendor_region | `drop_dm_object_name("All_Changes")` | inputlookup append=t previously_seen_cloud_regions | stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by vendor_region | where lastTimeSeen > relative_time(now(), `previously_seen_cloud_region_forget_window`) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-14d@d"), 1, 0) | outputlookup previously_seen_cloud_regions | stats count
 
-[ESCU - Previously Seen Users In CloudTrail - Update]
-action.escu = 0
-action.escu.enabled = 1
-action.escu.search_type = support
-action.escu.full_search_name = ESCU - Previously Seen Users In CloudTrail - Update
-description = This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by user, within the last hour.
-action.escu.creation_date = 2020-05-28
-action.escu.modification_date = 2020-05-28
-action.escu.analytic_story = ["Suspicious Cloud Authentication Activities"]
-action.escu.data_models = ["Authentication"]
-cron_schedule = 10 0 * * *
-enableSched = 1
-dispatch.earliest_time = -1450m@m
-dispatch.latest_time = -10m@m
-schedule_window = auto
-action.escu.providing_technologies = []
-action.escu.eli5 = This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by user, within the last hour.
-action.escu.how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_users_console_logins`, which is a lookup file created by this support search.
-disabled = false
-is_visible = false
-search = | tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | rename Authentication.user as user Authentication.src as src | table user src City Region Country firstTime lastTime | inputlookup append=t previously_seen_users_console_logins | stats min(firstTime) as firstTime max(lastTime) as lastTime by user src City Region Country | outputlookup previously_seen_users_console_logins
-
 [ESCU - Previously Seen Users in CloudTrail - Initial]
 action.escu = 0
 action.escu.enabled = 1
@@ -2491,10 +2469,53 @@ disabled = false
 is_visible = false
 search = | tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | rename Authentication.user as user Authentication.src as src | table user src City Region Country firstTime lastTime | outputlookup previously_seen_users_console_logins | stats count
 
+[ESCU - Previously Seen Users In CloudTrail - Update]
+action.escu = 0
+action.escu.enabled = 1
+action.escu.search_type = support
+action.escu.full_search_name = ESCU - Previously Seen Users In CloudTrail - Update
+description = This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by user, within the last hour.
+action.escu.creation_date = 2020-05-28
+action.escu.modification_date = 2020-05-28
+action.escu.analytic_story = ["Suspicious Cloud Authentication Activities"]
+action.escu.data_models = ["Authentication"]
+cron_schedule = 10 0 * * *
+enableSched = 1
+dispatch.earliest_time = -1450m@m
+dispatch.latest_time = -10m@m
+schedule_window = auto
+action.escu.providing_technologies = []
+action.escu.eli5 = This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by user, within the last hour.
+action.escu.how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_users_console_logins`, which is a lookup file created by this support search.
+disabled = false
+is_visible = false
+search = | tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | rename Authentication.user as user Authentication.src as src | table user src City Region Country firstTime lastTime | inputlookup append=t previously_seen_users_console_logins | stats min(firstTime) as firstTime max(lastTime) as lastTime by user src City Region Country | outputlookup previously_seen_users_console_logins
+
 
 
 ### ESCU RESPONSE TASKS ###
 
+[ESCU - Amazon EKS Kubernetes activity by src ip - Response Task]
+action.escu = 0
+action.escu.enabled = 1
+action.escu.search_type = investigative
+action.escu.full_search_name = ESCU - Amazon EKS Kubernetes activity by src ip - Response Task
+description = This search provides investigation data about requests via user agent, authentication request URI, verb and cluster name data against Kubernetes cluster from a specific IP address
+action.escu.creation_date = 2020-04-13
+action.escu.modification_date = 2020-04-13
+action.escu.analytic_story = ["Kubernetes Scanning Activity"]
+action.escu.earliest_time_offset = 3600
+action.escu.latest_time_offset = 86400
+action.escu.providing_technologies = []
+action.escu.data_models = []
+action.escu.eli5 = This search provides investigation data about requests via user agent, authentication request URI, verb and cluster name data against Kubernetes cluster from a specific IP address
+action.escu.how_to_implement = none
+action.escu.known_false_positives = None at this time
+disabled = true
+schedule_window = auto
+is_visible = false
+search = `aws_cloudwatchlogs_eks` |rename sourceIPs{} as src_ip |search src_ip=$src_ip$ | stats count min(_time) as firstTime max(_time) as lastTime values(user.username) values(requestURI) values(verb) values(userAgent) by source annotations.authorization.k8s.io/decision src_ip
+
 [ESCU - AWS Investigate Security Hub alerts by dest - Response Task]
 action.escu = 0
 action.escu.enabled = 1
@@ -2516,27 +2537,6 @@ schedule_window = auto
 is_visible = false
 search = `aws_securityhub_firehose` "findings{}.Resources{}.Type"=AWSEC2Instance | rex field=findings{}.Resources{}.Id .*instance/(?<instance>.*)| rename instance as dest| search dest = $dest$ |rename findings{}.* as * | rename Remediation.Recommendation.Text as Remediation |  table dest Title ProductArn Description FirstObservedAt RecordState Remediation
 
-[ESCU - AWS Investigate User Activities By ARN - Response Task]
-action.escu = 0
-action.escu.enabled = 1
-action.escu.search_type = investigative
-action.escu.full_search_name = ESCU - AWS Investigate User Activities By ARN - Response Task
-description = This search lists all the logged CloudTrail activities by a specific user ARN and will create a table containing the source of the user, the region of the activity, the name and type of the event, the action taken, and all the user's identity information.
-action.escu.creation_date = 2019-04-30
-action.escu.modification_date = 2019-04-30
-action.escu.analytic_story = ["AWS Cryptomining", "AWS Network ACL Activity", "Cloud Cryptomining", "Command and Control", "Suspicious AWS EC2 Activities", "Suspicious AWS Login Activities", "Suspicious AWS S3 Activities", "Suspicious AWS Traffic", "Unusual AWS EC2 Modifications", "Suspicious Cloud User Activities", "AWS Suspicious Provisioning Activities", "Suspicious Cloud Instance Activities", "AWS Security Hub Alerts"]
-action.escu.earliest_time_offset = 3600
-action.escu.latest_time_offset = 86400
-action.escu.providing_technologies = []
-action.escu.data_models = []
-action.escu.eli5 = This search lists all the logged CloudTrail activities by a specific user ARN and will create a table containing the source of the user, the region of the activity, the name and type of the event, the action taken, and all the user's identity information.
-action.escu.how_to_implement = none
-action.escu.known_false_positives = None at this time
-disabled = true
-schedule_window = auto
-is_visible = false
-search = `cloudtrail` | search user=$user$| table _time userIdentity.type userIdentity.userName userIdentity.arn aws_account_id src awsRegion eventName eventType
-
 [ESCU - AWS Investigate User Activities By AccessKeyId - Response Task]
 action.escu = 0
 action.escu.enabled = 1
@@ -2558,6 +2558,27 @@ schedule_window = auto
 is_visible = false
 search = `cloudtrail` | rename userIdentity.accessKeyId as accessKeyId| search accessKeyId=$accessKeyId$ | spath output=user path=userIdentity.arn  | rename sourceIPAddress as src_ip | table _time, user, src_ip, awsRegion, eventName, errorCode, errorMessage
 
+[ESCU - AWS Investigate User Activities By ARN - Response Task]
+action.escu = 0
+action.escu.enabled = 1
+action.escu.search_type = investigative
+action.escu.full_search_name = ESCU - AWS Investigate User Activities By ARN - Response Task
+description = This search lists all the logged CloudTrail activities by a specific user ARN and will create a table containing the source of the user, the region of the activity, the name and type of the event, the action taken, and all the user's identity information.
+action.escu.creation_date = 2019-04-30
+action.escu.modification_date = 2019-04-30
+action.escu.analytic_story = ["AWS Cryptomining", "AWS Network ACL Activity", "Cloud Cryptomining", "Command and Control", "Suspicious AWS EC2 Activities", "Suspicious AWS Login Activities", "Suspicious AWS S3 Activities", "Suspicious AWS Traffic", "Unusual AWS EC2 Modifications", "Suspicious Cloud User Activities", "AWS Suspicious Provisioning Activities", "Suspicious Cloud Instance Activities", "AWS Security Hub Alerts"]
+action.escu.earliest_time_offset = 3600
+action.escu.latest_time_offset = 86400
+action.escu.providing_technologies = []
+action.escu.data_models = []
+action.escu.eli5 = This search lists all the logged CloudTrail activities by a specific user ARN and will create a table containing the source of the user, the region of the activity, the name and type of the event, the action taken, and all the user's identity information.
+action.escu.how_to_implement = none
+action.escu.known_false_positives = None at this time
+disabled = true
+schedule_window = auto
+is_visible = false
+search = `cloudtrail` | search user=$user$| table _time userIdentity.type userIdentity.userName userIdentity.arn aws_account_id src awsRegion eventName eventType
+
 [ESCU - AWS Network ACL Details from ID - Response Task]
 action.escu = 0
 action.escu.enabled = 1
@@ -2621,27 +2642,6 @@ schedule_window = auto
 is_visible = false
 search = `aws_config` | rename resourceId as bucketName |search bucketName=$bucketName$ | table resourceCreationTime bucketName vendor_region action aws_account_id supplementaryConfiguration.AccessControlList
 
-[ESCU - Amazon EKS Kubernetes activity by src ip - Response Task]
-action.escu = 0
-action.escu.enabled = 1
-action.escu.search_type = investigative
-action.escu.full_search_name = ESCU - Amazon EKS Kubernetes activity by src ip - Response Task
-description = This search provides investigation data about requests via user agent, authentication request URI, verb and cluster name data against Kubernetes cluster from a specific IP address
-action.escu.creation_date = 2020-04-13
-action.escu.modification_date = 2020-04-13
-action.escu.analytic_story = ["Kubernetes Scanning Activity"]
-action.escu.earliest_time_offset = 3600
-action.escu.latest_time_offset = 86400
-action.escu.providing_technologies = []
-action.escu.data_models = []
-action.escu.eli5 = This search provides investigation data about requests via user agent, authentication request URI, verb and cluster name data against Kubernetes cluster from a specific IP address
-action.escu.how_to_implement = none
-action.escu.known_false_positives = None at this time
-disabled = true
-schedule_window = auto
-is_visible = false
-search = `aws_cloudwatchlogs_eks` |rename sourceIPs{} as src_ip |search src_ip=$src_ip$ | stats count min(_time) as firstTime max(_time) as lastTime values(user.username) values(requestURI) values(verb) values(userAgent) by source annotations.authorization.k8s.io/decision src_ip
-
 [ESCU - Get All AWS Activity From City - Response Task]
 action.escu = 0
 action.escu.enabled = 1
@@ -2768,27 +2768,6 @@ schedule_window = auto
 is_visible = false
 search = `cloudtrail` dest=$dest$ |rename userIdentity.arn as arn, responseElements.instancesSet.items{}.instanceId as dest, responseElements.instancesSet.items{}.privateIpAddress as privateIpAddress, responseElements.instancesSet.items{}.imageId as amiID, responseElements.instancesSet.items{}.architecture as architecture, responseElements.instancesSet.items{}.keyName as keyName | table arn, awsRegion, dest, architecture, privateIpAddress, amiID, keyName
 
-[ESCU - Investigate AWS User Activities by user field - Response Task]
-action.escu = 0
-action.escu.enabled = 1
-action.escu.search_type = investigative
-action.escu.full_search_name = ESCU - Investigate AWS User Activities by user field - Response Task
-description = This search lists all the logged CloudTrail activities by a specific user and will create a table containing the source of the user, the region of the activity, the name and type of the event, the action taken, and the user's identity information.
-action.escu.creation_date = 2018-03-12
-action.escu.modification_date = 2018-03-12
-action.escu.analytic_story = ["AWS User Monitoring", "Suspicious Cloud Authentication Activities"]
-action.escu.earliest_time_offset = 3600
-action.escu.latest_time_offset = 86400
-action.escu.providing_technologies = []
-action.escu.data_models = []
-action.escu.eli5 = This search lists all the logged CloudTrail activities by a specific user and will create a table containing the source of the user, the region of the activity, the name and type of the event, the action taken, and the user's identity information.
-action.escu.how_to_implement = none
-action.escu.known_false_positives = None at this time
-disabled = true
-schedule_window = auto
-is_visible = false
-search = `cloudtrail` user=$user$ | table _time userIdentity.type userIdentity.userName userIdentity.arn aws_account_id src awsRegion eventName eventType 
-
 [ESCU - Investigate AWS activities via region name - Response Task]
 action.escu = 0
 action.escu.enabled = 1
@@ -2810,6 +2789,27 @@ schedule_window = auto
 is_visible = false
 search = `cloudtrail` vendor_region=$vendor_region$| rename requestParameters.instancesSet.items{}.instanceId as instanceId | stats values(eventName) by user instanceId vendor_region
 
+[ESCU - Investigate AWS User Activities by user field - Response Task]
+action.escu = 0
+action.escu.enabled = 1
+action.escu.search_type = investigative
+action.escu.full_search_name = ESCU - Investigate AWS User Activities by user field - Response Task
+description = This search lists all the logged CloudTrail activities by a specific user and will create a table containing the source of the user, the region of the activity, the name and type of the event, the action taken, and the user's identity information.
+action.escu.creation_date = 2018-03-12
+action.escu.modification_date = 2018-03-12
+action.escu.analytic_story = ["AWS User Monitoring", "Suspicious Cloud Authentication Activities"]
+action.escu.earliest_time_offset = 3600
+action.escu.latest_time_offset = 86400
+action.escu.providing_technologies = []
+action.escu.data_models = []
+action.escu.eli5 = This search lists all the logged CloudTrail activities by a specific user and will create a table containing the source of the user, the region of the activity, the name and type of the event, the action taken, and the user's identity information.
+action.escu.how_to_implement = none
+action.escu.known_false_positives = None at this time
+disabled = true
+schedule_window = auto
+is_visible = false
+search = `cloudtrail` user=$user$ | table _time userIdentity.type userIdentity.userName userIdentity.arn aws_account_id src awsRegion eventName eventType 
+
 
 
 ### END ESCU RESPONSE TASKS ###
\ No newline at end of file
diff --git a/dist/saaws/default/transforms.conf b/dist/saaws/default/transforms.conf
index fbf26057fa..7b44ffebb6 100644
--- a/dist/saaws/default/transforms.conf
+++ b/dist/saaws/default/transforms.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-10-28T22:30:45 UTC
+# On Date: 2021-11-01T18:33:43 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
diff --git a/dist/ssa/detections/applying_stolen_credentials_via_mimikatz_modules.yml b/dist/ssa/detections/applying_stolen_credentials_via_mimikatz_modules.yml
new file mode 100644
index 0000000000..59991812db
--- /dev/null
+++ b/dist/ssa/detections/applying_stolen_credentials_via_mimikatz_modules.yml
@@ -0,0 +1,91 @@
+author: Stanislav Miskovic, Splunk
+datamodel: []
+date: '2020-11-03'
+description: This detection indicates use of Mimikatz modules that facilitate Pass-the-Token
+  attack, Golden or Silver kerberos ticket attack, and Skeleton key attack.
+how_to_implement: You must be ingesting Windows Security logs from devices of interest,
+  including the event ID 4688 with enabled command line logging.
+id: 759a653f-cb92-40f9-94c9-ec4e47b0f709
+known_false_positives: None identified.
+name: Applying Stolen Credentials via Mimikatz modules
+product:
+- Splunk Behavioral Analytics
+references:
+- https://github.com/gentilkiwi/mimikatz
+- https://adsecurity.org/?p=1275
+risk_message: Mimikatz malware is violating authentication processes by injecting
+  golden or silver Kerberos tickets or passing stolen authentication tokens. Operation
+  is performed at the device $dest_device_id$, by the account $dest_user_id$ via command
+  $cmd_line$
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line != null AND ( match_regex(cmd_line, /(?i)kerberos::ptt/)=true OR match_regex(cmd_line,
+  /(?i)kerberos::golden/)=true OR match_regex(cmd_line, /(?i)kerberos::silver/)=true
+  OR match_regex(cmd_line, /(?i)misc::skeleton/)=true )
+
+  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
+  | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Credential Dumping
+  asset_type: Windows
+  cis20:
+  - CIS 16
+  - CIS 20
+  confidence: 100
+  context:
+  - Source:AD
+  - Source:Endpoint
+  - Stage:Credential Access
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555/applying_stolen_credentials/logAllMimikatzModules.log
+  impact: 90
+  kill_chain_phases:
+  - Actions on Objectives
+  message: Mimikatz malware is violating authentication processes by injecting golden
+    or silver Kerberos tickets or passing stolen authentication tokens. Operation
+    is performed at the device $dest_device_id$, by the account $dest_user_id$ via
+    command $cmd_line$
+  mitre_attack_id:
+  - T1055
+  - T1068
+  - T1078
+  - T1098
+  - T1134
+  - T1543
+  - T1547
+  - T1548
+  - T1554
+  - T1556
+  - T1558
+  nist:
+  - PR.AC
+  - PR.IP
+  observable:
+  - name: dest_user_id
+    role:
+    - Actor
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: cmd_line
+    role:
+    - Others
+    type: processname
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - dest_device_id
+  - dest_user_id
+  - process
+  - _time
+  risk_score: 90
+  risk_severity: high
+  security_domain: endpoint
+type: TTP
+version: 1
diff --git a/dist/ssa/detections/applying_stolen_credentials_via_powersploit_modules.yml b/dist/ssa/detections/applying_stolen_credentials_via_powersploit_modules.yml
new file mode 100644
index 0000000000..e6493fea5e
--- /dev/null
+++ b/dist/ssa/detections/applying_stolen_credentials_via_powersploit_modules.yml
@@ -0,0 +1,95 @@
+author: Stanislav Miskovic, Splunk
+datamodel: []
+date: '2020-11-03'
+description: Stolen credentials are applied by methods such as user impersonation,
+  credential injection, spoofing of authentication processes or getting hold of critical
+  accounts. This detection indicates such activities carried out by PowerSploit exploit
+  kit APIs.
+how_to_implement: You must be ingesting Windows Security logs from devices of interest,
+  including the event ID 4688 with enabled command line logging.
+id: 270b482d-2af2-448f-9923-9cf005f61be4
+known_false_positives: None identified.
+name: Applying Stolen Credentials via PowerSploit modules
+product:
+- Splunk Behavioral Analytics
+references:
+- https://github.com/PowerShellMafia/PowerSploit
+risk_message: PowerSploit malware is violating authentication by injecting stolen
+  credentials, manipulating authentication tokens or impersonating system or user
+  accounts. Operation is performed at the device $dest_device_id$, by the account
+  $dest_user_id$ via command $cmd_line$
+search: '| from read_ssa_enriched_events()
+
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
+  "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
+  /(?i)Invoke-CredentialInjection/)=true OR match_regex(cmd_line, /(?i)Invoke-TokenManipulation/)=true
+  OR match_regex(cmd_line, /(?i)Invoke-UserImpersonation/)=true OR match_regex(cmd_line,
+  /(?i)Get-System/)=true OR match_regex(cmd_line, /(?i)Invoke-RevertToSelf/)=true
+  )
+
+  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
+  | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Credential Dumping
+  asset_type: Windows
+  cis20:
+  - CIS 16
+  - CIS 20
+  confidence: 100
+  context:
+  - Source:AD
+  - Source:Endpoint
+  - Stage:Credential Access
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555/applying_stolen_credentials/logAllPowerSploitModulesWithOldNames.log
+  impact: 90
+  kill_chain_phases:
+  - Actions on Objectives
+  message: PowerSploit malware is violating authentication by injecting stolen credentials,
+    manipulating authentication tokens or impersonating system or user accounts. Operation
+    is performed at the device $dest_device_id$, by the account $dest_user_id$ via
+    command $cmd_line$
+  mitre_attack_id:
+  - T1055
+  - T1068
+  - T1078
+  - T1098
+  - T1134
+  - T1543
+  - T1547
+  - T1548
+  - T1554
+  - T1555
+  - T1558
+  nist:
+  - PR.AC
+  - PR.IP
+  observable:
+  - name: dest_user_id
+    role:
+    - Actor
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: cmd_line
+    role:
+    - Others
+    type: processname
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - dest_device_id
+  - dest_user_id
+  - process
+  - _time
+  risk_score: 90
+  risk_severity: high
+  security_domain: endpoint
+type: TTP
+version: 1
diff --git a/dist/ssa/detections/assessment_of_credential_strength_via_dsinternals_modules.yml b/dist/ssa/detections/assessment_of_credential_strength_via_dsinternals_modules.yml
new file mode 100644
index 0000000000..97c52f250d
--- /dev/null
+++ b/dist/ssa/detections/assessment_of_credential_strength_via_dsinternals_modules.yml
@@ -0,0 +1,80 @@
+author: Stanislav Miskovic, Splunk
+datamodel: []
+date: '2020-11-03'
+description: This detection identifies use of DSInternals modules that verify password
+  strength, i.e., identify week accounts that would be easily compromised.
+how_to_implement: You must be ingesting Windows Security logs from devices of interest,
+  including the event ID 4688 with enabled command line logging.
+id: 5526d3a4-2497-4e8d-9d3c-7a34c9aace2f
+known_false_positives: None identified.
+name: Assessment of Credential Strength via DSInternals modules
+product:
+- Splunk Behavioral Analytics
+references:
+- https://github.com/MichaelGrafnetter/DSInternals
+risk_message: DSInternals tool kit is assessing password strength at the device $dest_device_id$.
+  Account attempting this operation is $dest_user_id$ via command $cmd_line$
+search: '| from read_ssa_enriched_events()
+
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
+  "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
+  /(?i)Test-PasswordQuality/)=true )
+
+  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
+  | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Credential Dumping
+  asset_type: Windows
+  cis20:
+  - CIS 16
+  - CIS 20
+  confidence: 85
+  context:
+  - Source:AD
+  - Source:Endpoint
+  - Stage:Recon
+  - Stage:Credential Access
+  impact: 30
+  kill_chain_phases:
+  - Actions on Objectives
+  message: DSInternals tool kit is assessing password strength at the device $dest_device_id$.
+    Account attempting this operation is $dest_user_id$ via command $cmd_line$
+  mitre_attack_id:
+  - T1078
+  - T1098
+  - T1087
+  - T1201
+  - T1552
+  - T1555
+  nist:
+  - PR.AC
+  - PR.IP
+  observable:
+  - name: dest_user_id
+    role:
+    - Actor
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: cmd_line
+    role:
+    - Others
+    type: processname
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - process
+  - dest_device_id
+  - dest_user_id
+  risk_score: 25
+  risk_severity: medium
+  security_domain: endpoint
+type: TTP
+version: 1
diff --git a/dist/ssa/detections/attempt_to_delete_services.yml b/dist/ssa/detections/attempt_to_delete_services.yml
new file mode 100644
index 0000000000..4e4711df40
--- /dev/null
+++ b/dist/ssa/detections/attempt_to_delete_services.yml
@@ -0,0 +1,61 @@
+author: Teoderick Contreras, splunk
+datamodel:
+- Endpoint
+date: '2021-06-18'
+description: This analytic identifies suspicious series of attempt to kill multiple
+  services on a system using either `net.exe` or `sc.exe`. This technique is use by
+  adversaries to terminate security services or other related services to continue
+  there objective and evade detections.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed sc.exe may be used.
+id: a0c8c292-d01a-11eb-aa18-acde48001122
+known_false_positives: unknown
+name: Attempt To delete Services
+product:
+- Splunk Behavioral Analytics
+references:
+- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND like(cmd_line, "%delete%") AND process_name = "sc.exe"
+  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name, "parent_process_name", parent_process_name, "process_path", process_path])
+  | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - XMRig
+  - Ransomware
+  cis20:
+  - CIS 8
+  - CIS 13
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/sc_del.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1489
+  nist:
+  - PR.DS
+  - PR.IP
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  risk_severity: high
+  security_domain: endpoint
+type: TTP
+version: 2
diff --git a/dist/ssa/detections/attempt_to_disable_services.yml b/dist/ssa/detections/attempt_to_disable_services.yml
new file mode 100644
index 0000000000..4910940788
--- /dev/null
+++ b/dist/ssa/detections/attempt_to_disable_services.yml
@@ -0,0 +1,63 @@
+author: Teoderick Contreras, Splunk
+datamodel:
+- Endpoint
+date: '2021-06-18'
+description: This analytic will identify suspicious series of command-line to disable
+  several services. This technique is seen where the adversary attempts to disable
+  security app services or other malware services to complete the objective on the
+  compromised system.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed sc.exe may be used.
+id: afb31de4-d023-11eb-98d5-acde48001122
+known_false_positives: unknown
+name: Attempt To Disable Services
+product:
+- Splunk Behavioral Analytics
+references:
+- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
+- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/
+search: '| from read_ssa_enriched_events() | eval _datamodels=ucast(map_get(input_event,
+  "_datamodels"), "collection<string>", []), body={} | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND like(cmd_line, "%disabled%") AND like(cmd_line, "%config%")
+  AND process_name="sc.exe" | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name, "parent_process_name", parent_process_name, "process_path", process_path])
+  | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - XMRig
+  - Ransomware
+  cis20:
+  - CIS 9
+  - CIS 8
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/sc_disable.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1489
+  nist:
+  - PR.DS
+  - PR.IP
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  risk_severity: medium
+  security_domain: endpoint
+type: TTP
+version: 2
diff --git a/dist/ssa/detections/attempted_credential_dump_from_registry_via_reg_exe.yml b/dist/ssa/detections/attempted_credential_dump_from_registry_via_reg_exe.yml
new file mode 100644
index 0000000000..0dad28f8eb
--- /dev/null
+++ b/dist/ssa/detections/attempted_credential_dump_from_registry_via_reg_exe.yml
@@ -0,0 +1,80 @@
+author: Jose Hernandez, Splunk
+datamodel: []
+date: 2020-6-04
+description: Monitor for execution of reg.exe with parameters specifying an export
+  of keys that contain hashed credentials that attackers may try to crack offline.
+how_to_implement: You must be ingesting windows endpoint data that tracks process
+  activity, including parent-child relationships from your endpoints.
+id: 14038953-e5f2-4daf-acff-5452062baf03
+known_false_positives: None identified.
+name: Attempted Credential Dump From Registry via Reg exe
+product:
+- Splunk Behavioral Analytics
+references:
+- https://github.com/splunk/security_content/blob/55a17c65f9f56c2220000b62701765422b46125d/detections/attempted_credential_dump_from_registry_via_reg_exe.yml
+risk_message: Malicious actor is dumping stored credentials from the registry sections
+  SAM, Security, or System. Operation is performed at the device $dest_device_id$,
+  by the account $dest_user_id$ via command $cmd_line$
+search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)) | eval process_name=lower(ucast(map_get(input_event,
+  "process_name"), "string", null)), cmd_line=ucast(map_get(input_event, "process"),
+  "string", null), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string",
+  null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where process_name="cmd.exe"
+  OR process_name="reg.exe" | where cmd_line != null  AND match_regex(cmd_line, /(?i)save\s+/)=true
+  AND ( match_regex(cmd_line, /(?i)HKLM\\Security/)=true OR match_regex(cmd_line,
+  /(?i)HKLM\\SAM/)=true OR match_regex(cmd_line, /(?i)HKLM\\System/)=true OR match_regex(cmd_line,
+  /(?i)HKEY_LOCAL_MACHINE\\Security/)=true OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\SAM/)=true
+  OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\System/)=true ) | eval start_time
+  = timestamp, end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id),
+  body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name])
+  | into write_ssa_detected_events(); '
+tags:
+  analytic_story:
+  - Credential Dumping
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 90
+  context:
+  - Source:AD
+  - Source:Endpoint
+  - Stage:Credential Access
+  impact: 70
+  kill_chain_phases:
+  - Actions on Objectives
+  message: Malicious actor is dumping stored credentials from the registry sections
+    SAM, Security, or System. Operation is performed at the device $dest_device_id$,
+    by the account $dest_user_id$ via command $cmd_line$
+  mitre_attack_id:
+  - T1003
+  nist:
+  - DE.CM
+  observable:
+  - name: dest_user_id
+    role:
+    - Actor
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: cmd_line
+    role:
+    - Others
+    type: processname
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - process_name
+  - _time
+  - dest_device_id
+  - dest_user_id
+  - process
+  risk_score: 63
+  risk_severity: low
+  security_domain: endpoint
+type: TTP
+version: 1
diff --git a/dist/ssa/detections/credential_extraction_indicative_of_fgdump_and_cachedump_with_s_option.yml b/dist/ssa/detections/credential_extraction_indicative_of_fgdump_and_cachedump_with_s_option.yml
new file mode 100644
index 0000000000..2737015eda
--- /dev/null
+++ b/dist/ssa/detections/credential_extraction_indicative_of_fgdump_and_cachedump_with_s_option.yml
@@ -0,0 +1,89 @@
+author: Stanislav Miskovic, Splunk
+datamodel: []
+date: '2020-10-18'
+description: Credential extraction is often an illegal recovery of credential material
+  from secured authentication resources and repositories. This process may also involve
+  decryption or other transformations of the stored credential material. FGdump is
+  a newer version of pwdump tool that extracts NTLM and LanMan password hashes from
+  Windows. Cachedump is a publicly-available tool that extracts cached password hashes
+  from a system's registry.
+how_to_implement: You must be ingesting Windows Security logs from devices of interest,
+  including the event ID 4688 with enabled command line logging.
+id: 312582f2-5e91-42c1-a275-cd67f31373c8
+known_false_positives: None identified.
+name: Credential Extraction indicative of FGDump and CacheDump with s option
+product:
+- Splunk Behavioral Analytics
+references: []
+risk_message: Malicious actor is accessing stored credentials via FGDump or CacheDump
+  tools. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
+  via command $cmd_line$
+search: ' | from read_ssa_enriched_events()
+
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
+  "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
+  "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line != null AND process_name != null AND parent_process_name != null
+  AND match_regex(parent_process_name, /(?i)System32\\services.exe/)=true AND match_regex(process_name,
+  /(?i)cachedump\d{0,2}.exe/)=true AND match_regex(process_path, /(?i)\\Temp/)=true
+  AND match_regex(cmd_line, /(?i)\-s/)=true
+
+  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name, "parent_process_name", parent_process_name]) | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Unusual Processes
+  - Credential Dumping
+  asset_type: Windows
+  cis20:
+  - CIS 16
+  confidence: 100
+  context:
+  - Source:AD
+  - Source:Endpoint
+  - Stage:Credential Access
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logFgdump.log
+  impact: 70
+  kill_chain_phases:
+  - Actions on Objectives
+  message: Malicious actor is accessing stored credentials via FGDump or CacheDump
+    tools. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
+    via command $cmd_line$
+  mitre_attack_id:
+  - T1003
+  nist:
+  - PR.AC
+  - PR.IP
+  observable:
+  - name: dest_user_id
+    role:
+    - Actor
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: cmd_line
+    role:
+    - Others
+    type: processname
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - _time
+  - process_path
+  - dest_user_id
+  - process
+  risk_score: 70
+  risk_severity: low
+  security_domain: endpoint
+type: TTP
+version: 1
diff --git a/dist/ssa/detections/credential_extraction_indicative_of_fgdump_and_cachedump_with_v_option.yml b/dist/ssa/detections/credential_extraction_indicative_of_fgdump_and_cachedump_with_v_option.yml
new file mode 100644
index 0000000000..5a22fae726
--- /dev/null
+++ b/dist/ssa/detections/credential_extraction_indicative_of_fgdump_and_cachedump_with_v_option.yml
@@ -0,0 +1,86 @@
+author: Stanislav Miskovic, Splunk
+datamodel: []
+date: '2020-10-18'
+description: Credential extraction is often an illegal recovery of credential material
+  from secured authentication resources and repositories. This process may also involve
+  decryption or other transformations of the stored credential material. FGdump is
+  a newer version of pwdump tool that extracts NTLM and LanMan password hashes from
+  Windows. Cachedump is a publicly-available tool that extracts cached password hashes
+  from a system's registry.
+how_to_implement: You must be ingesting Windows Security logs from devices of interest,
+  including the event ID 4688 with enabled command line logging.
+id: 3c40b0ef-a03f-460a-9484-e4b9117cbb38
+known_false_positives: None identified.
+name: Credential Extraction indicative of FGDump and CacheDump with v option
+product:
+- Splunk Behavioral Analytics
+references: []
+risk_message: Malicious actor is accessing stored credentials via FGDump or CacheDump
+  tools. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
+  via command $cmd_line$
+search: ' | from read_ssa_enriched_events()
+
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
+  "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line != null AND process_name != null AND process_path != null AND match_regex(process_name,
+  /(?i)cachedump\d{0,2}.exe/)=true AND match_regex(process_path, /(?i)\\Temp/)=true
+  AND match_regex(cmd_line, /(?i)\-v/)=true
+
+  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name]) | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Unusual Processes
+  - Credential Dumping
+  asset_type: Windows
+  cis20:
+  - CIS 16
+  confidence: 90
+  context:
+  - Source:AD
+  - Source:Endpoint
+  - Stage:Credential Access
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logFgdump.log
+  impact: 70
+  kill_chain_phases:
+  - Actions on Objectives
+  message: Malicious actor is accessing stored credentials via FGDump or CacheDump
+    tools. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
+    via command $cmd_line$
+  mitre_attack_id:
+  - T1003
+  nist:
+  - PR.AC
+  - PR.IP
+  observable:
+  - name: dest_user_id
+    role:
+    - Actor
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: cmd_line
+    role:
+    - Others
+    type: processname
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - dest_device_id
+  - process_name
+  - _time
+  - process_path
+  - dest_user_id
+  - process
+  risk_score: 63
+  risk_severity: low
+  security_domain: endpoint
+type: TTP
+version: 1
diff --git a/dist/ssa/detections/credential_extraction_indicative_of_lazagne_command_line_options.yml b/dist/ssa/detections/credential_extraction_indicative_of_lazagne_command_line_options.yml
new file mode 100644
index 0000000000..ed25c18052
--- /dev/null
+++ b/dist/ssa/detections/credential_extraction_indicative_of_lazagne_command_line_options.yml
@@ -0,0 +1,80 @@
+author: Stanislav Miskovic, Splunk
+datamodel: []
+date: '2020-10-18'
+description: Credential extraction is often an illegal recovery of credential material
+  from secured authentication resources and repositories. This process may also involve
+  decryption or other transformations of the stored credential material. LaZagne is
+  a tool that extracts various kinds of credentials from a local computer, including
+  account passwords, domain passwords, browser passwords, etc.
+how_to_implement: You must be ingesting Windows Security logs from devices of interest,
+  including the event ID 4688 with enabled command line logging.
+id: 341975fa-4ad0-4f01-9acc-df4f69742db7
+known_false_positives: None identified.
+name: Credential Extraction indicative of Lazagne command line options
+product:
+- Splunk Behavioral Analytics
+references: []
+risk_message: Lazagne malware is extracting/decoding encoded credentials. Operation
+  is performed at the device $dest_device_id$, by the account $dest_user_id$ via command
+  $cmd_line$
+search: ' | from read_ssa_enriched_events()
+
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
+  "event_id"), "string", null) | where cmd_line != null AND match_regex(cmd_line,
+  /(?i)all\s+\-oA\s+\-output/)=true
+
+  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
+  | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Credential Dumping
+  asset_type: Windows
+  cis20:
+  - CIS 16
+  confidence: 90
+  context:
+  - Source:AD
+  - Source:Endpoint
+  - Stage:Credential Access
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logLazagneCredDump.log
+  impact: 70
+  kill_chain_phases:
+  - Actions on Objectives
+  message: Lazagne malware is extracting/decoding encoded credentials. Operation is
+    performed at the device $dest_device_id$, by the account $dest_user_id$ via command
+    $cmd_line$
+  mitre_attack_id:
+  - T1003
+  - T1555
+  nist:
+  - PR.IP
+  - PR.AC
+  observable:
+  - name: dest_user_id
+    role:
+    - Actor
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: cmd_line
+    role:
+    - Others
+    type: processname
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - dest_device_id
+  - dest_user_id
+  - process
+  - _time
+  risk_score: 63
+  risk_severity: low
+  security_domain: endpoint
+type: TTP
+version: 1
diff --git a/dist/ssa/detections/credential_extraction_indicative_of_use_of_dsinternals_credential_conversion_modules.yml b/dist/ssa/detections/credential_extraction_indicative_of_use_of_dsinternals_credential_conversion_modules.yml
new file mode 100644
index 0000000000..7a8d5e84a8
--- /dev/null
+++ b/dist/ssa/detections/credential_extraction_indicative_of_use_of_dsinternals_credential_conversion_modules.yml
@@ -0,0 +1,92 @@
+author: Stanislav Miskovic, Splunk
+datamodel: []
+date: '2020-10-21'
+description: Credential extraction is often an illegal recovery of credential material
+  from secured authentication resources and repositories. This process may also involve
+  decryption or other transformations of the stored credential material. DSInternals
+  is a collection of PowerShell modules commonly employed in exploits.
+how_to_implement: You must be ingesting Windows Security logs from devices of interest,
+  including the event ID 4688 with enabled command line logging.
+id: 73e23834-c7ad-4860-bfd0-7d8ffe6527c2
+known_false_positives: None identified.
+name: Credential Extraction indicative of use of DSInternals credential conversion
+  modules
+product:
+- Splunk Behavioral Analytics
+references:
+- https://github.com/MichaelGrafnetter/DSInternals
+risk_message: DSInternals tool kit is converting stolen credential material to a form
+  applicable to authentications. Operation is performed at the device $dest_device_id$,
+  by the account $dest_user_id$ via command $cmd_line$
+search: '| from read_ssa_enriched_events()
+
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event,
+  "process_path"), "string", null), cmd_line=ucast(map_get(input_event, "process"),
+  "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line != null AND ( match_regex(cmd_line, /(?i)ConvertFrom-ADManagedPasswordBlob/)=true
+  OR match_regex(cmd_line, /(?i)ConvertFrom-GPPrefPassword/)=true OR match_regex(cmd_line,
+  /(?i)ConvertFrom-UnicodePassword/)=true OR match_regex(cmd_line, /(?i)ConvertTo-GPPrefPassword/)=true
+  OR match_regex(cmd_line, /(?i)ConvertTo-KerberosKey/)=true OR match_regex(cmd_line,
+  /(?i)ConvertTo-LMHash/)=true OR match_regex(cmd_line, /(?i)ConvertTo-NTHash/)=true
+  OR match_regex(cmd_line, /(?i)ConvertTo-OrgIdHash/)=true OR match_regex(cmd_line,
+  /(?i)ConvertTo-UnicodePassword/)=true )
+
+  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name]) | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Credential Dumping
+  - Malicious PowerShell
+  asset_type: Windows
+  cis20:
+  - CIS 16
+  confidence: 100
+  context:
+  - Source:AD
+  - Source:Endpoint
+  - Stage:Credential Access
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllDSInternalsModules.log
+  impact: 70
+  kill_chain_phases:
+  - Actions on Objectives
+  message: DSInternals tool kit is converting stolen credential material to a form
+    applicable to authentications. Operation is performed at the device $dest_device_id$,
+    by the account $dest_user_id$ via command $cmd_line$
+  mitre_attack_id:
+  - T1003
+  nist:
+  - PR.AC
+  - PR.IP
+  observable:
+  - name: dest_user_id
+    role:
+    - Actor
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: cmd_line
+    role:
+    - Others
+    type: processname
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - _time
+  - process_path
+  - dest_user_id
+  - process
+  risk_score: 70
+  risk_severity: low
+  security_domain: endpoint
+type: TTP
+version: 1
diff --git a/dist/ssa/detections/credential_extraction_indicative_of_use_of_dsinternals_modules.yml b/dist/ssa/detections/credential_extraction_indicative_of_use_of_dsinternals_modules.yml
new file mode 100644
index 0000000000..d02922041d
--- /dev/null
+++ b/dist/ssa/detections/credential_extraction_indicative_of_use_of_dsinternals_modules.yml
@@ -0,0 +1,95 @@
+author: Stanislav Miskovic, Splunk
+datamodel: []
+date: '2020-10-21'
+description: Credential extraction is often an illegal recovery of credential material
+  from secured authentication resources and repositories. This process may also involve
+  decryption or other transformations of the stored credential material. DSInternals
+  is a collection of PowerShell modules commonly employed in exploits.
+how_to_implement: You must be ingesting Windows Security logs from devices of interest,
+  including the event ID 4688 with enabled command line logging.
+id: 5d2172f0-8a7d-4ecd-aad9-2dcc95699e0d
+known_false_positives: None identified.
+name: Credential Extraction indicative of use of DSInternals modules
+product:
+- Splunk Behavioral Analytics
+references:
+- https://github.com/MichaelGrafnetter/DSInternals
+risk_message: DSInternals tool kit is accessing sensitive credential material such
+  as KDS root key, or accessing sensitive authentication infrastructure such as LsaPolicyInformation.
+  Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
+  via command $cmd_line$
+search: '| from read_ssa_enriched_events()
+
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event,
+  "process_path"), "string", null), cmd_line=ucast(map_get(input_event, "process"),
+  "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-ADDBBackupKey/)=true
+  OR match_regex(cmd_line, /(?i)Get-ADDBDomainController/)=true OR match_regex(cmd_line,
+  /(?i)Get-ADDBKdsRootKey/)=true OR match_regex(cmd_line, /(?i)Get-ADDBSchemaAttribute/)=true
+  OR match_regex(cmd_line, /(?i)Get-ADKeyCredential/)=true OR match_regex(cmd_line,
+  /(?i)Get-ADReplAccount/)=true OR match_regex(cmd_line, /(?i)Get-ADReplBackupKey/)=true
+  OR match_regex(cmd_line, /(?i)Get-ADSIAccount/)=true OR match_regex(cmd_line, /(?i)Get-AzureADUserEx/)=true
+  OR match_regex(cmd_line, /(?i)Get-BootKey/)=true OR match_regex(cmd_line, /(?i)Get-LsaBackupKey/)=true
+  OR match_regex(cmd_line, /(?i)Get-LsaPolicyInformation/)=true OR match_regex(cmd_line,
+  /(?i)Get-SamPasswordPolicy/)=true )
+
+  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name]) | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Credential Dumping
+  - Malicious PowerShell
+  asset_type: Windows
+  cis20:
+  - CIS 16
+  confidence: 100
+  context:
+  - Source:AD
+  - Source:Endpoint
+  - Stage:Credential Access
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllDSInternalsModules.log
+  impact: 70
+  kill_chain_phases:
+  - Actions on Objectives
+  message: DSInternals tool kit is accessing sensitive credential material such as
+    KDS root key, or accessing sensitive authentication infrastructure such as LsaPolicyInformation.
+    Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
+    via command $cmd_line$
+  mitre_attack_id:
+  - T1003
+  nist:
+  - PR.AC
+  - PR.IP
+  observable:
+  - name: dest_user_id
+    role:
+    - Actor
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: cmd_line
+    role:
+    - Others
+    type: processname
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - _time
+  - process_path
+  - dest_user_id
+  - process
+  risk_score: 70
+  risk_severity: low
+  security_domain: endpoint
+type: TTP
+version: 1
diff --git a/dist/ssa/detections/credential_extraction_indicative_of_use_of_mimikatz_modules.yml b/dist/ssa/detections/credential_extraction_indicative_of_use_of_mimikatz_modules.yml
new file mode 100644
index 0000000000..4175d1eb9f
--- /dev/null
+++ b/dist/ssa/detections/credential_extraction_indicative_of_use_of_mimikatz_modules.yml
@@ -0,0 +1,85 @@
+author: Stanislav Miskovic, Splunk
+datamodel: []
+date: '2020-10-21'
+description: Credential extraction is often an illegal recovery of credential material
+  from secured authentication resources and repositories. This process may also involve
+  decryption or other transformations of the stored credential material. Mimikatz
+  is a collection of tools and modules commonly employed in Windows exploits.
+how_to_implement: You must be ingesting Windows Security logs from devices of interest,
+  including the event ID 4688 with enabled command line logging.
+id: 966b635f-98e8-4aa4-9b49-47ed2cedcc85
+known_false_positives: None identified.
+name: Credential Extraction indicative of use of Mimikatz modules
+product:
+- Splunk Behavioral Analytics
+references:
+- https://github.com/gentilkiwi/mimikatz
+risk_message: Mimikatz malware is extracting/decoding encoded credentials from stores
+  such as SAM or LSA dumps. Operation is performed at the device $dest_device_id$,
+  by the account $dest_user_id$ via command $cmd_line$
+search: '| from read_ssa_enriched_events()
+
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
+  "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
+  /(?i)CRYPTO::Certificates/)=true OR match_regex(cmd_line, /(?i)CRYPTO::keys/)=true
+  OR match_regex(cmd_line, /(?i)kerberos::list/)=true OR match_regex(cmd_line, /(?i)kerberos::tgt/)=true
+  OR match_regex(cmd_line, /(?i)lsadump::sam/)=true OR match_regex(cmd_line, /(?i)lsadump::secrets/)=true
+  OR match_regex(cmd_line, /(?i)lsadump::cache/)=true OR match_regex(cmd_line, /(?i)lsadump::lsa/)=true
+  OR match_regex(cmd_line, /(?i)lsadump::trust/)=true OR match_regex(cmd_line, /(?i)lsadump::backupkeys/)=true
+  )
+
+  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
+  | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Credential Dumping
+  - Unusual Processes
+  asset_type: Windows
+  cis20:
+  - CIS 16
+  confidence: 95
+  context:
+  - Source:AD
+  - Source:Endpoint
+  - Stage:Credential Access
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllMimikatzModules.log
+  impact: 70
+  kill_chain_phases:
+  - Actions on Objectives
+  message: Mimikatz malware is extracting/decoding encoded credentials from stores
+    such as SAM or LSA dumps. Operation is performed at the device $dest_device_id$,
+    by the account $dest_user_id$ via command $cmd_line$
+  mitre_attack_id:
+  - T1003
+  nist:
+  - PR.AC
+  - PR.IP
+  observable:
+  - name: dest_user_id
+    role:
+    - Actor
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: cmd_line
+    role:
+    - Others
+    type: processname
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - dest_device_id
+  - dest_user_id
+  - process
+  - _time
+  risk_score: 66
+  risk_severity: low
+  security_domain: endpoint
+type: TTP
+version: 1
diff --git a/dist/ssa/detections/credential_extraction_indicative_of_use_of_powersploit_modules.yml b/dist/ssa/detections/credential_extraction_indicative_of_use_of_powersploit_modules.yml
new file mode 100644
index 0000000000..7d45538479
--- /dev/null
+++ b/dist/ssa/detections/credential_extraction_indicative_of_use_of_powersploit_modules.yml
@@ -0,0 +1,86 @@
+author: Stanislav Miskovic, Splunk
+datamodel: []
+date: '2020-10-21'
+description: Credential extraction is often an illegal recovery of credential material
+  from secured authentication resources and repositories. This process may also involve
+  decryption or other transformations of the stored credential material. PowerSploit
+  is a collection of Microsoft PowerShell modules commonly employed in exploits.
+how_to_implement: You must be ingesting Windows Security logs from devices of interest,
+  including the event ID 4688 with enabled command line logging.
+id: 5f1186a4-e681-446e-851c-dc9574ad28eb
+known_false_positives: None identified.
+name: Credential Extraction indicative of use of PowerSploit modules
+product:
+- Splunk Behavioral Analytics
+references:
+- https://github.com/PowerShellMafia/PowerSploit
+risk_message: PowerSploit malware is extracting encoded credentials or spoofing automated
+  logings. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
+  via command $cmd_line$
+search: '| from read_ssa_enriched_events()
+
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
+  "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
+  /(?i)Get-ApplicationHost/)=true OR match_regex(cmd_line, /(?i)Get-CachedGPPPassword/)=true
+  OR match_regex(cmd_line, /(?i)Get-GPPAutologon/)=true OR match_regex(cmd_line, /(?i)Get-GPPPassword/)=true
+  OR match_regex(cmd_line, /(?i)Get-RegistryAutoLogon/)=true OR match_regex(cmd_line,
+  /(?i)Get-SiteListPassword/)=true OR match_regex(cmd_line, /(?i)Get-SPNTicket/)=true
+  OR match_regex(cmd_line, /(?i)Request-SPNTicket/)=true OR match_regex(cmd_line,
+  /(?i)Get-VaultCredential/)=true OR match_regex(cmd_line, /(?i)Invoke-Kerberoast/)=true
+  )
+
+  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
+  | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Credential Dumping
+  - Malicious PowerShell
+  asset_type: Windows
+  cis20:
+  - CIS 16
+  confidence: 100
+  context:
+  - Source:AD
+  - Source:Endpoint
+  - Stage:Credential Access
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log
+  impact: 70
+  kill_chain_phases:
+  - Actions on Objectives
+  message: PowerSploit malware is extracting encoded credentials or spoofing automated
+    logings. Operation is performed at the device $dest_device_id$, by the account
+    $dest_user_id$ via command $cmd_line$
+  mitre_attack_id:
+  - T1003
+  nist:
+  - PR.AC
+  - PR.IP
+  observable:
+  - name: dest_user_id
+    role:
+    - Actor
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: cmd_line
+    role:
+    - Others
+    type: processname
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - dest_device_id
+  - dest_user_id
+  - process
+  - _time
+  risk_score: 70
+  risk_severity: low
+  security_domain: endpoint
+type: TTP
+version: 1
diff --git a/dist/ssa/detections/credential_extraction_native_microsoft_debuggers_peek_into_the_kernel.yml b/dist/ssa/detections/credential_extraction_native_microsoft_debuggers_peek_into_the_kernel.yml
new file mode 100644
index 0000000000..d30e85ce9c
--- /dev/null
+++ b/dist/ssa/detections/credential_extraction_native_microsoft_debuggers_peek_into_the_kernel.yml
@@ -0,0 +1,90 @@
+author: Stanislav Miskovic, Splunk
+datamodel: []
+date: '2020-10-18'
+description: Credential extraction is often an illegal recovery of credential material
+  from secured authentication resources and repositories. This process may also involve
+  decryption or other transformations of the stored credential material. Native Microsoft
+  debuggers, such as kd, ntkd, livekd and windbg, can be leveraged to read credential
+  material directly from memory and process dumps.
+how_to_implement: You must be ingesting Windows Security logs from devices of interest,
+  including the event ID 4688 with enabled command line logging.
+id: c20bb8ec-e1b0-4640-b0ef-3a4c54f8c112
+known_false_positives: Although unlikely, using debuggers this way may be indicative
+  of developers analyzing crash dumps of their code. Note, even for developers this
+  is an unusual way of working on code - debuggers are mostly used to step through
+  code, not analyze its crash dumps.
+name: Credential Extraction native Microsoft debuggers peek into the kernel
+product:
+- Splunk Behavioral Analytics
+references:
+- https://medium.com/@clermont1050/covid-19-cyber-infection-c615ead7c29
+risk_message: Malicious actor is extracting/decoding encoded credentials via Microsoft's
+  native debugging tools. Operation is performed at the device $dest_device_id$, by
+  the account $dest_user_id$ via command $cmd_line$
+search: ' | from read_ssa_enriched_events()
+
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
+  "process_name"), "string", null), parent_process_name=ucast(map_get(input_event,
+  "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"),
+  "string", null) | where cmd_line != null AND parent_process_name != null AND process_name
+  != null  AND ( match_regex(parent_process_name, /(?i)ntkd\.exe/)=true OR match_regex(parent_process_name,
+  /(?i)livekd\.exe/)=true ) AND match_regex(process_name, /(?i)conhost\.exe/)=true
+  AND match_regex(cmd_line, /(?i)0xffffffff/)=true AND match_regex(cmd_line, /(?i)\-ForceV1/)=true
+
+  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name, "parent_process_name", parent_process_name]) | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Credential Dumping
+  - Unusual Processes
+  asset_type: Windows
+  cis20:
+  - CIS 16
+  confidence: 90
+  context:
+  - Source:AD
+  - Source:Endpoint
+  - Stage:Credential Access
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logLiveKDFullKernelDump.log
+  impact: 70
+  kill_chain_phases:
+  - Actions on Objectives
+  message: Malicious actor is extracting/decoding encoded credentials via Microsoft's
+    native debugging tools. Operation is performed at the device $dest_device_id$,
+    by the account $dest_user_id$ via command $cmd_line$
+  mitre_attack_id:
+  - T1003
+  nist:
+  - PR.IP
+  - PR.AC
+  observable:
+  - name: dest_user_id
+    role:
+    - Actor
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: cmd_line
+    role:
+    - Others
+    type: processname
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - process_name
+  - parent_process_name
+  - _time
+  - dest_device_id
+  - dest_user_id
+  - process
+  risk_score: 63
+  risk_severity: low
+  security_domain: endpoint
+type: TTP
+version: 1
diff --git a/dist/ssa/detections/credential_extraction_native_microsoft_debuggers_via_z_command_line_option.yml b/dist/ssa/detections/credential_extraction_native_microsoft_debuggers_via_z_command_line_option.yml
new file mode 100644
index 0000000000..1e950758a5
--- /dev/null
+++ b/dist/ssa/detections/credential_extraction_native_microsoft_debuggers_via_z_command_line_option.yml
@@ -0,0 +1,86 @@
+author: Stanislav Miskovic, Splunk
+datamodel: []
+date: '2020-10-18'
+description: Credential extraction is often an illegal recovery of credential material
+  from secured authentication resources and repositories. This process may also involve
+  decryption or other transformations of the stored credential material. Native Microsoft
+  debuggers, such as kd, ntkd, livekd and windbg, can be leveraged to read credential
+  material directly from memory and process dumps.
+how_to_implement: You must be ingesting Windows Security logs from devices of interest,
+  including the event ID 4688 with enabled command line logging.
+id: adc51a77-90c9-4358-b43c-f10dd1a27d05
+known_false_positives: Although unlikely, using debuggers this way may be indicative
+  of developers analyzing crash dumps of their code. Note, even for developers this
+  is an unusual way of working on code - debuggers are mostly used to step through
+  code, not analyze its crash dumps.
+name: Credential Extraction native Microsoft debuggers via z command line option
+product:
+- Splunk Behavioral Analytics
+references: []
+risk_message: Malicious actor is extracting/decoding encoded credentials via Microsoft's
+  native debugging tools. Operation is performed at the device $dest_device_id$, by
+  the account $dest_user_id$ via command $cmd_line$
+search: ' | from read_ssa_enriched_events()
+
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
+  "process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"),
+  "string", null) | where cmd_line != null AND process_name != null AND ( match_regex(process_name,
+  /^(?i)ntkd\.exe/)=true OR match_regex(process_name, /^(?i)kd\.exe/)=true ) AND match_regex(cmd_line,
+  /(?i)\-z\s+/)=true
+
+  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name]) | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Credential Dumping
+  - Unusual Processes
+  asset_type: Windows
+  cis20:
+  - CIS 16
+  confidence: 90
+  context:
+  - Source:AD
+  - Source:Endpoint
+  - Stage:Credential Access
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logLiveKDFullKernelDump.log
+  impact: 70
+  kill_chain_phases:
+  - Actions on Objectives
+  message: Malicious actor is extracting/decoding encoded credentials via Microsoft's
+    native debugging tools. Operation is performed at the device $dest_device_id$,
+    by the account $dest_user_id$ via command $cmd_line$
+  mitre_attack_id:
+  - T1003
+  nist:
+  - PR.AC
+  - PR.IP
+  observable:
+  - name: dest_user_id
+    role:
+    - Actor
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: cmd_line
+    role:
+    - Others
+    type: processname
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - process_name
+  - _time
+  - dest_device_id
+  - dest_user_id
+  - process
+  risk_score: 63
+  risk_severity: low
+  security_domain: endpoint
+type: TTP
+version: 1
diff --git a/dist/ssa/detections/credential_extraction_via_get-addbaccount_module_present_in_powersploit_and_dsinternals.yml b/dist/ssa/detections/credential_extraction_via_get-addbaccount_module_present_in_powersploit_and_dsinternals.yml
new file mode 100644
index 0000000000..cd54f57691
--- /dev/null
+++ b/dist/ssa/detections/credential_extraction_via_get-addbaccount_module_present_in_powersploit_and_dsinternals.yml
@@ -0,0 +1,81 @@
+author: Stanislav Miskovic, Splunk
+datamodel: []
+date: '2020-10-18'
+description: Credential extraction is often an illegal recovery of credential material
+  from secured authentication resources and repositories. This process may also involve
+  decryption or other transformations of the stored credential material. PowerSploit
+  and DSInternals are common exploit APIs offering PowerShell modules for various
+  exploits of Windows and Active Directory environments.
+how_to_implement: You must be ingesting Windows Security logs from devices of interest,
+  including the event ID 4688 with enabled command line logging.
+id: e4f126b5-e6bc-4a5c-b1a8-d07bc6c4a49f
+known_false_positives: None identified.
+name: Credential Extraction via Get-ADDBAccount module present in PowerSploit and
+  DSInternals
+product:
+- Splunk Behavioral Analytics
+references: []
+risk_message: PowerSploit malware is accessing stored credentials via Get-ADDBAccount
+  module. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
+  via command $cmd_line$
+search: ' | from read_ssa_enriched_events()
+
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
+  "event_id"), "string", null) | where cmd_line != null AND match_regex(cmd_line,
+  /(?i)Get-ADDBAccount/)=true AND match_regex(cmd_line, /(?i)\-dbpath[\s;:\.\|]+/)=true
+
+  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
+  | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Credential Dumping
+  - Malicious PowerShell
+  asset_type: Windows
+  cis20:
+  - CIS 16
+  confidence: 90
+  context:
+  - Source:AD
+  - Source:Endpoint
+  - Stage:Credential Access
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logPowerShellModule.log
+  impact: 70
+  kill_chain_phases:
+  - Actions on Objectives
+  message: PowerSploit malware is accessing stored credentials via Get-ADDBAccount
+    module. Operation is performed at the device $dest_device_id$, by the account
+    $dest_user_id$ via command $cmd_line$
+  mitre_attack_id:
+  - T1003
+  nist:
+  - PR.IP
+  - PR.AC
+  observable:
+  - name: dest_user_id
+    role:
+    - Actor
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: cmd_line
+    role:
+    - Others
+    type: processname
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - dest_device_id
+  - dest_user_id
+  - process
+  - _time
+  risk_score: 63
+  risk_severity: low
+  security_domain: endpoint
+type: TTP
+version: 1
diff --git a/dist/ssa/detections/delete_a_net_user.yml b/dist/ssa/detections/delete_a_net_user.yml
new file mode 100644
index 0000000000..e38926b2ee
--- /dev/null
+++ b/dist/ssa/detections/delete_a_net_user.yml
@@ -0,0 +1,64 @@
+author: Teoderick Contreras, Splunk
+datamodel:
+- Endpoint
+date: '2021-06-21'
+description: This analytic will detect a suspicious net.exe/net1.exe command-line
+  to delete a user on a system. This technique may be use by an administrator for
+  legitimate purposes, however this behavior has been used in the wild to impair some
+  user or deleting adversaries tracks created during its lateral movement additional
+  systems. During triage, review parallel processes for additional behavior. Identify
+  any other user accounts created before or after.
+how_to_implement: o successfully implement this search, you need to be ingesting logs
+  with the process name, parent process, and command-line executions from your endpoints.
+  If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+  Tune and filter known instances where renamed net.exe may be used.
+id: 8776d79c-d26e-11eb-9a56-acde48001122
+known_false_positives: System administrators or scripts may delete user accounts via
+  this technique. Filter as needed.
+name: Delete A Net User
+product:
+- Splunk Behavioral Analytics
+references:
+- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND like(cmd_line, "%/delete%") AND (process_name="net1.exe"
+  OR process_name="net.exe") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name, "parent_process_name", parent_process_name, "process_path", process_path])
+  | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - XMRig
+  - Ransomware
+  cis20:
+  - CIS 4
+  - CIS 16
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/net_user_del.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1489
+  nist:
+  - PR.AC
+  - PR.IP
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  risk_severity: high
+  security_domain: endpoint
+type: Anomaly
+version: 2
diff --git a/dist/ssa/detections/deny_permission_using_cacls_utility.yml b/dist/ssa/detections/deny_permission_using_cacls_utility.yml
new file mode 100644
index 0000000000..8db36bc4e7
--- /dev/null
+++ b/dist/ssa/detections/deny_permission_using_cacls_utility.yml
@@ -0,0 +1,80 @@
+author: Teoderick Contreras, Splunk
+datamodel:
+- Endpoint
+date: '2021-06-14'
+description: This analytic identifies a potential adversary that changes the security
+  permission of a specific file or directory. This technique is commonly seen in APT
+  tradecraft, ransomware or coinminer scripts. This behavior is meant to evade detection
+  and prevent access to their component files.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used.
+id: b76eae28-cd25-11eb-9c92-acde48001122
+known_false_positives: network administrator may use this windows utility but this
+  is not a common practice.
+name: Deny Permission using Cacls Utility
+product:
+- Splunk Behavioral Analytics
+references:
+- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
+risk_message: A cacls process $process_name$ with commandline $cmd_line$ try to deny
+  a permission of a file or directory in host $dest_device_id$
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
+  null), process_name=ucast(map_get(input_event, "process_name"), "string", null),
+  process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event,
+  "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"),
+  "string", null) | where cmd_line IS NOT NULL AND match_regex(cmd_line, /(?i)deny/)=true
+  AND (process_name="cacls.exe" OR process_name="xcacls.exe" OR process_name="icacls.exe")
+  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name, "parent_process_name", parent_process_name, "process_path", process_path])
+  | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - XMRig
+  cis20:
+  - CIS 14
+  - CIS 16
+  confidence: 70
+  context:
+  - source:endpoint
+  - stage: Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log
+  impact: 50
+  kill_chain_phases:
+  - Exploitation
+  message: A cacls process $process_name$ with commandline $cmd_line$ try to deny
+    a permission of a file or directory in host $dest_device_id$
+  mitre_attack_id:
+  - T1222
+  nist:
+  - PR.AC
+  - PR.IP
+  observable:
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: dest_user_id
+    role:
+    - Victim
+    type: user
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  risk_score: 35
+  risk_severity: medium
+  security_domain: endpoint
+type: TTP
+version: 2
diff --git a/dist/ssa/detections/detect_dump_lsass_memory_using_comsvcs.yml b/dist/ssa/detections/detect_dump_lsass_memory_using_comsvcs.yml
new file mode 100644
index 0000000000..b1c7914dfb
--- /dev/null
+++ b/dist/ssa/detections/detect_dump_lsass_memory_using_comsvcs.yml
@@ -0,0 +1,79 @@
+author: Jose Hernandez, Splunk
+datamodel: []
+date: '2020-09-15'
+description: This search detects the memory of lsass.exe being dumped for offline
+  credential theft attack.
+how_to_implement: You must be ingesting endpoint data that tracks process activity,
+  including Windows command line logging. You can see how we test this with [Event
+  Code 4688](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4688a)
+  on the [attack_range](https://github.com/splunk/attack_range/blob/develop/ansible/roles/windows_common/tasks/windows-enable-4688-cmd-line-audit.yml).
+id: 76bb9e35-f314-4c3d-a385-83c72a13ce4e
+known_false_positives: None identified.
+name: Detect Dump LSASS Memory using comsvcs
+product:
+- Splunk Behavioral Analytics
+references:
+- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
+risk_message: Malicious actor is dumping encoded credentials via Microsoft's native
+  comsvc DLL. Operation is performed at the device $dest_device_id$, by the account
+  $dest_user_id$ via command $cmd_line$
+search: '| from read_ssa_enriched_events() | eval tenant=ucast(map_get(input_event,
+  "_tenant"), "string", null), machine=ucast(map_get(input_event, "dest_device_id"),
+  "string", null), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
+  null)), process=lower(ucast(map_get(input_event, "process"), "string", null)), event_id=ucast(map_get(input_event,
+  "event_id"), "string", null) | where process_name LIKE "%rundll32.exe%" AND match_regex(process,
+  /(?i)comsvcs.dll[,\s]+MiniDump/)=true | eval start_time = timestamp, end_time =
+  timestamp, entities = mvappend(machine), body=create_map(["event_id", event_id,
+  "process_name", process_name, "process", process]) | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Credential Dumping
+  asset_type: Endpoint
+  cis20:
+  - CIS 8
+  - CIS 16
+  confidence: 100
+  context:
+  - Source:AD
+  - Source:Endpoint
+  - Stage:Credential Access
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-security.log
+  impact: 70
+  kill_chain_phases:
+  - Actions on Objectives
+  message: Malicious actor is dumping encoded credentials via Microsoft's native comsvc
+    DLL. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
+    via command $cmd_line$
+  mitre_attack_id:
+  - T1003.003
+  - T1003
+  nist:
+  - DE.CM
+  observable:
+  - name: dest_user_id
+    role:
+    - Actor
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: cmd_line
+    role:
+    - Others
+    type: processname
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - process_name
+  - _tenant
+  - _time
+  - dest_device_id
+  - process
+  risk_score: 70
+  risk_severity: low
+  security_domain: endpoint
+type: TTP
+version: 1
diff --git a/dist/ssa/detections/detect_kerberoasting.yml b/dist/ssa/detections/detect_kerberoasting.yml
new file mode 100644
index 0000000000..b13d0b9267
--- /dev/null
+++ b/dist/ssa/detections/detect_kerberoasting.yml
@@ -0,0 +1,82 @@
+author: Xiao Lin, Splunk
+datamodel: []
+date: '2020-10-21'
+description: This search detects a potential kerberoasting attack via service principal
+  name requests
+how_to_implement: The test data is converted from Windows Security Event logs generated
+  from Attach Range simulation and used in SPL search and extended to SPL2
+id: dabdd6d7-3e10-42be-8711-4e124f7a3850
+known_false_positives: Older systems that support kerberos RC4 by default NetApp may
+  generate false positives
+name: Detect Kerberoasting
+product:
+- Splunk Behavioral Analytics
+references:
+- Initial ESCU implementation by Jose Hernandez and Patrick Bareiss
+risk_message: Kerberoasting malware is potentially applying stolen credentials. Operation
+  is performed at the device $dest_device_id$, by the account $dest_user_id$ via command
+  $cmd_line$
+search: ' | from read_ssa_enriched_events() | eval _time=map_get(input_event, "_time"),
+  EventCode=map_get(input_event, "event_code"), TicketOptions=map_get(input_event,
+  "ticket_options"), TicketEncryptionType=map_get(input_event, "ticket_encryption_type"),
+  ServiceName=map_get(input_event, "service_name"), ServiceID=map_get(input_event,
+  "service_id"), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string",
+  null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where EventCode="4769"
+  AND TicketOptions="0x40810000" AND TicketEncryptionType="0x17" | first_time_event
+  input_columns=["EventCode","TicketOptions","TicketEncryptionType","ServiceName","ServiceID"]
+  | where first_time_EventCode_TicketOptions_TicketEncryptionType_ServiceName_ServiceID
+  | eval start_time=_time, end_time=_time, body=create_map(["event_id", event_id,
+  "EventCode", EventCode, "ServiceName", ServiceName, "TicketOptions", TicketOptions,
+  "TicketEncryptionType", TicketEncryptionType]), entities = mvappend( ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null))| select start_time, end_time, entities, body | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Credential Dumping
+  cis20:
+  - CIS 8
+  - CIS 16
+  confidence: 20
+  context:
+  - Source:AD
+  - Source:Endpoint
+  - Stage:Credential Access
+  impact: 70
+  kill_chain_phases:
+  - Actions on Objectives
+  message: Kerberoasting malware is potentially applying stolen credentials. Operation
+    is performed at the device $dest_device_id$, by the account $dest_user_id$ via
+    command $cmd_line$
+  mitre_attack_id:
+  - T1558.003
+  - T1558
+  nist:
+  - DE.CM
+  observable:
+  - name: dest_user_id
+    role:
+    - Actor
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: cmd_line
+    role:
+    - Others
+    type: processname
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - service_name
+  - _time
+  - event_code
+  - ticket_encryption_type
+  - service_id
+  - ticket_options
+  risk_score: 14
+  risk_severity: medium
+  security_domain: endpoint
+type: TTP
+version: 2
diff --git a/dist/ssa/detections/detect_pass_the_hash.yml b/dist/ssa/detections/detect_pass_the_hash.yml
new file mode 100644
index 0000000000..9f263ff519
--- /dev/null
+++ b/dist/ssa/detections/detect_pass_the_hash.yml
@@ -0,0 +1,87 @@
+author: Xiao Lin, Splunk
+datamodel: []
+date: '2020-10-21'
+description: This search looks for specific authentication events from the Windows
+  Security Event logs to detect potential attempts using Pass-the-Hash technique.
+how_to_implement: The test data is converted from Windows Security Event logs generated
+  from Attach Range simulation and used in SPL search and extended to SPL2
+id: 7cd8b9fa-6b0c-424f-92a6-9c5287a72f5f
+known_false_positives: Legitimate logon activity by authorized NTLM systems may be
+  detected by this search. Please investigate as appropriate.
+name: Detect Pass the Hash
+product:
+- Splunk Behavioral Analytics
+references:
+- Initial ESCU implementation by Bhavin Patel and Patrick Bareiss
+risk_message: Potential use of the pass the hash/token attacks that spoof authentication.
+  Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
+  via command $cmd_line$
+search: ' | from read_ssa_enriched_events()
+
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null))
+  | eval signature_id=map_get(input_event, "signature_id"), authentication_type=map_get(input_event,
+  "authentication_type"), authentication_method=map_get(input_event, "authentication_method"),
+  origin_device_domain=map_get(input_event, "origin_device_domain"), dest_user_id=ucast(map_get(input_event,
+  "dest_user_id"), "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"),
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+
+  | where (authentication_type="3" AND authentication_method="NtLmSsp") OR (authentication_type="9"
+  AND authentication_method="seclogo")
+
+  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id,
+  dest_user_id), body=create_map(["event_id", event_id, "authentication_type", authentication_type,
+  "authentication_method", authentication_method]) | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Lateral Movement
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 20
+  context:
+  - Source:AD
+  - Source:Endpoint
+  - Stage:Credential Access
+  impact: 80
+  kill_chain_phases:
+  - Actions on Objectives
+  message: Potential use of the pass the hash/token attacks that spoof authentication.
+    Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
+    via command $cmd_line$
+  mitre_attack_id:
+  - T1550
+  - T1550.002
+  nist:
+  - PR.PT
+  - PR.AT
+  - PR.AC
+  - PR.IP
+  observable:
+  - name: dest_user_id
+    role:
+    - Actor
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: cmd_line
+    role:
+    - Others
+    type: processname
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - signature_id
+  - authentication_type
+  - _time
+  - authentication_method
+  - origin_device_domain
+  - dest_user_id
+  - dest_device_id
+  risk_score: 16
+  risk_severity: medium
+  security_domain: endpoint
+type: TTP
+version: 1
diff --git a/dist/ssa/detections/detect_prohibited_applications_spawning_cmd_exe.yml b/dist/ssa/detections/detect_prohibited_applications_spawning_cmd_exe.yml
new file mode 100644
index 0000000000..3f956fddcf
--- /dev/null
+++ b/dist/ssa/detections/detect_prohibited_applications_spawning_cmd_exe.yml
@@ -0,0 +1,89 @@
+author: Ignacio Bermudez Corrales, Splunk
+datamodel: []
+date: 2020-7-13
+description: This search looks for executions of cmd.exe spawned by a process that
+  is often abused by attackers and that does not typically launch cmd.exe. This is
+  a SPL2 implementation of the rule `Detect Prohibited Applications Spawning cmd.exe`
+  by @bpatel.
+how_to_implement: You must be ingesting sysmon logs. This search has been modified
+  to process raw sysmon data from attack_range's nxlogs on DSP.
+id: c10a18cb-fd80-4ffa-a844-25026e0a0c94
+known_false_positives: There are circumstances where an application may legitimately
+  execute and interact with the Windows command-line interface. Investigate and modify
+  the lookup file, as appropriate.
+name: Detect Prohibited Applications Spawning cmd exe
+product:
+- Splunk Behavioral Analytics
+references: []
+risk_message: Potential malicious landing to the console via unexpected programs that
+  called cmd.exe.  Operation is performed at the device $dest_device_id$, by the account
+  $dest_user_id$ where parent process $parent_process$ spwaned $process_name$.
+search: '| from read_ssa_enriched_events()
+
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null))
+  | eval process_name=ucast(map_get(input_event, "process_name"), "string", null),
+  parent_process=lower(ucast(map_get(input_event, "parent_process_name"), "string",
+  null)), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null),
+  dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null), event_id=ucast(map_get(input_event,
+  "event_id"), "string", null)
+
+  | where process_name="cmd.exe" | rex field=parent_process "(?<field0>[^\\\\]+)$"
+  | where field0="winword.exe" OR field0="excel.exe" OR field0="outlook.exe" OR field0="powerpnt.exe"
+  OR field0="visio.exe" OR field0="mspub.exe" OR field0="acrobat.exe" OR field0="acrord32.exe"
+  OR field0="chrome.exe" OR field0="iexplore.exe" OR field0="opera.exe" OR field0="firefox.exe"
+  OR field0="java.exe" OR field0="powershell.exe"
+
+  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id,
+  dest_user_id), body=create_map(["event_id", event_id,  "process_name", process_name,
+  "parent_process_name", parent_process]) | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Suspicious Command-Line Executions
+  - Suspicious MSHTA Activity
+  - Suspicious Zoom Child Processes
+  - Sunburst Malware
+  cis20:
+  - CIS 8
+  confidence: 80
+  context:
+  - Source:AD
+  - Source:Endpoint
+  - Stage:Command And Control
+  - Consequence:Loss Of Control
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: Potential malicious landing to the console via unexpected programs that
+    called cmd.exe.  Operation is performed at the device $dest_device_id$, by the
+    account $dest_user_id$ where parent process $parent_process$ spwaned $process_name$.
+  mitre_attack_id:
+  - T1059
+  nist:
+  - PR.PT
+  - DE.CM
+  observable:
+  - name: dest_user_id
+    role:
+    - Actor
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: cmd_line
+    role:
+    - Others
+    type: processname
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - process_name
+  - parent_process_name
+  - _time
+  - dest_device_id
+  - dest_user_id
+  risk_score: 56
+  risk_severity: low
+  security_domain: endpoint
+type: TTP
+version: 1
diff --git a/dist/ssa/detections/disable_net_user_account.yml b/dist/ssa/detections/disable_net_user_account.yml
new file mode 100644
index 0000000000..6bdecec8ff
--- /dev/null
+++ b/dist/ssa/detections/disable_net_user_account.yml
@@ -0,0 +1,63 @@
+author: Teoderick Contreras, Splunk
+datamodel:
+- Endpoint
+date: '2021-06-21'
+description: This analytic will identify a suspicious command-line that disables a
+  user account using the `net.exe` utility native to Windows. This technique may used
+  by the adversaries to interrupt availability of such users to do their malicious
+  act.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed net.exe/net1.exe may be
+  used.
+id: ba858b08-d26c-11eb-af9b-acde48001122
+known_false_positives: network operator may use this approach to quickly disable an
+  account but not a common practice.
+name: Disable Net User Account
+product:
+- Splunk Behavioral Analytics
+references:
+- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND like(cmd_line, "%/active:no%") AND (process_name="net1.exe"
+  OR process_name="net.exe") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name, "parent_process_name", parent_process_name, "process_path", process_path])
+  | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - XMRig
+  - Ransomware
+  cis20:
+  - CIS 4
+  - CIS 16
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/net_user_dis.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1489
+  nist:
+  - PR.AC
+  - PR.IP
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  risk_severity: medium
+  security_domain: endpoint
+type: TTP
+version: 2
diff --git a/dist/ssa/detections/first_time_seen_command_line_argument.yml b/dist/ssa/detections/first_time_seen_command_line_argument.yml
new file mode 100644
index 0000000000..31cac23810
--- /dev/null
+++ b/dist/ssa/detections/first_time_seen_command_line_argument.yml
@@ -0,0 +1,82 @@
+author: Ignacio Bermudez Corrales, Splunk
+datamodel: []
+date: 2021-2-1
+description: This search looks for command-line arguments that use a `/c` parameter
+  to execute a command that has not previously been seen. This is an implementation
+  on SPL2 of the rule `First time seen command line argument` by @bpatel.
+how_to_implement: You must be populating the endpoint data model for SSA and specifically
+  the process_name and the process fields
+id: fc0edc95-ff2b-48b0-9f6f-63da3789fd23
+known_false_positives: Legitimate programs can also use command-line arguments to
+  execute. Please verify the command-line arguments to check what command/program
+  is being executed. We recommend customizing the `first_time_seen_cmd_line_filter`
+  macro to exclude legitimate parent_process_name
+name: First time seen command line argument
+product:
+- Splunk Behavioral Analytics
+references: []
+risk_message: A cmd process $process_name$ with commandline $cmd_line$ try to execute
+  command has not previously seen in host $dest_device_id$
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)) | eval dest_user_id=ucast(map_get(input_event, "dest_user_id"),
+  "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string",
+  null), process_name=ucast(map_get(input_event, "process_name"), "string", null),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), cmd_line_norm=lower(cmd_line),
+  cmd_line_norm=replace(cmd_line_norm, /[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}/,
+  "GUID"), cmd_line_norm=replace(cmd_line_norm, /(?<=\s)+\\[^:]*(?=\\.*\.\w{3}(\s|$)+)/,
+  "\\PATH"), /* replaces " \\Something\\Something\\command.ext" => "PATH\\command.ext"
+  */ cmd_line_norm=replace(cmd_line_norm, /\w:\\[^:]*(?=\\.*\.\w{3}(\s|$)+)/, "\\PATH"),
+  /* replaces "C:\\Something\\Something\\command.ext" => "PATH\\command.ext" */ cmd_line_norm=replace(cmd_line_norm,
+  /\d+/, "N"), event_id=ucast(map_get(input_event, "event_id"), "string", null) |
+  where process_name="cmd.exe" AND match_regex(ucast(cmd_line, "string", ""), /.*
+  \/[cC] .*/)=true | select process_name, cmd_line, cmd_line_norm, timestamp, dest_device_id,
+  dest_user_id | first_time_event input_columns=["cmd_line_norm"] | where first_time_cmd_line_norm
+  | eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id,
+  dest_user_id), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name]) | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Unusual Processes
+  cis20:
+  - CIS 3
+  - CIS 8
+  confidence: 60
+  context:
+  - source:endpoint
+  - stage: Defense Evasion
+  impact: 50
+  kill_chain_phases:
+  - Command and Control
+  - Actions on Objectives
+  message: A cmd process $process_name$ with commandline $cmd_line$ try to execute
+    command has not previously seen in host $dest_device_id$
+  mitre_attack_id:
+  - T1059
+  - T1117
+  - T1202
+  nist:
+  - PR.PT
+  - DE.CM
+  - PR.IP
+  observable:
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: dest_user_id
+    role:
+    - Victim
+    type: user
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - process_name
+  - _time
+  - dest_device_id
+  - dest_user_id
+  - process
+  risk_score: 30
+  risk_severity: medium
+  security_domain: endpoint
+type: Anomaly
+version: 3
diff --git a/dist/ssa/detections/grant_permission_using_cacls_utility.yml b/dist/ssa/detections/grant_permission_using_cacls_utility.yml
new file mode 100644
index 0000000000..72d50af052
--- /dev/null
+++ b/dist/ssa/detections/grant_permission_using_cacls_utility.yml
@@ -0,0 +1,80 @@
+author: Teoderick Contreras, Splunk
+datamodel:
+- Endpoint
+date: '2021-06-14'
+description: This analytic identifies potential adversaries that modify the security
+  permission of a specific file or directory. This technique is commonly seen in APT
+  tradecraft, ransomware and coinminer scripts to evade detections and restrict access
+  to their component files.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used.
+id: c6da561a-cd29-11eb-ae65-acde48001122
+known_false_positives: network administrator may use this windows utility but this
+  is not a common practice.
+name: Grant Permission Using Cacls Utility
+product:
+- Splunk Behavioral Analytics
+references:
+- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
+risk_message: A cacls process $process_name$ with commandline $cmd_line$ try to grant
+  user a permission to a file or directory in host $dest_device_id$
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
+  null), process_name=ucast(map_get(input_event, "process_name"), "string", null),
+  process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event,
+  "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"),
+  "string", null) | where cmd_line IS NOT NULL AND match_regex(cmd_line, /(?i)grant/)=true
+  AND (process_name="cacls.exe" OR process_name="xcacls.exe" OR process_name="icacls.exe")
+  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name, "parent_process_name", parent_process_name, "process_path", process_path])
+  | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - XMRig
+  cis20:
+  - CIS 14
+  - CIS 16
+  confidence: 70
+  context:
+  - source:endpoint
+  - stage: Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log
+  impact: 50
+  kill_chain_phases:
+  - Exploitation
+  message: A cacls process $process_name$ with commandline $cmd_line$ try to grant
+    user a permission to a file or directory in host $dest_device_id$
+  mitre_attack_id:
+  - T1222
+  nist:
+  - PR.AC
+  - PR.IP
+  observable:
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: dest_user_id
+    role:
+    - Victim
+    type: user
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  risk_score: 35
+  risk_severity: medium
+  security_domain: endpoint
+type: TTP
+version: 2
diff --git a/dist/ssa/detections/illegal_access_to_user_content_via_powersploit_modules.yml b/dist/ssa/detections/illegal_access_to_user_content_via_powersploit_modules.yml
new file mode 100644
index 0000000000..83a0227bb6
--- /dev/null
+++ b/dist/ssa/detections/illegal_access_to_user_content_via_powersploit_modules.yml
@@ -0,0 +1,87 @@
+author: Stanislav Miskovic, Splunk
+datamodel: []
+date: '2020-11-09'
+description: This detection identifies access to PowerSploit modules that enable illegaly
+  access user content, such as key logging, audio recording, screenshots, tapping
+  into http and RDP sessions, etc.
+how_to_implement: You must be ingesting Windows Security logs from devices of interest,
+  including the event ID 4688 with enabled command line logging.
+id: 01fc7d91-eb0c-478e-8633-e4fa4904463a
+known_false_positives: None identified.
+name: Illegal Access To User Content via PowerSploit modules
+product:
+- Splunk Behavioral Analytics
+references:
+- https://github.com/PowerShellMafia/PowerSploit
+risk_message: PowerSploit malware is tapping into user content - microphone, camera,
+  ongoing HTTP or RDP session. Operation is performed at the device $dest_device_id$,
+  by the account $dest_user_id$ via command $cmd_line$
+search: '| from read_ssa_enriched_events()
+
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
+  "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
+  /(?i)Get-HttpStatus/)=true OR match_regex(cmd_line, /(?i)Get-Keystrokes/)=true OR
+  match_regex(cmd_line, /(?i)Get-MicrophoneAudio/)=true OR match_regex(cmd_line, /(?i)Get-NetRDPSession/)=true
+  OR match_regex(cmd_line, /(?i)Get-TimedScreenshot/)=true OR match_regex(cmd_line,
+  /(?i)Get-WebConfig/)=true )
+
+  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
+  | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Malicious PowerShell
+  asset_type: Windows
+  cis20:
+  - CIS 16
+  - CIS 20
+  confidence: 100
+  context:
+  - Source:AD
+  - Source:Endpoint
+  - Stage:Exfiltration
+  - Stage:Command And Control
+  - Consequence:Loss Of Control
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021/illegal_access_to_content/logAllPowerSploitModulesWithOldNames.log
+  impact: 85
+  kill_chain_phases:
+  - Actions on Objectives
+  message: PowerSploit malware is tapping into user content - microphone, camera,
+    ongoing HTTP or RDP session. Operation is performed at the device $dest_device_id$,
+    by the account $dest_user_id$ via command $cmd_line$
+  mitre_attack_id:
+  - T1021
+  - T1113
+  - T1123
+  - T1563
+  nist:
+  - PR.AC
+  - PR.IP
+  observable:
+  - name: dest_user_id
+    role:
+    - Actor
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: cmd_line
+    role:
+    - Others
+    type: processname
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - dest_device_id
+  - dest_user_id
+  - process
+  - _time
+  risk_score: 85
+  risk_severity: high
+  security_domain: endpoint
+type: TTP
+version: 1
diff --git a/dist/ssa/detections/illegal_account_creation_via_powersploit_modules.yml b/dist/ssa/detections/illegal_account_creation_via_powersploit_modules.yml
new file mode 100644
index 0000000000..15a2017e7f
--- /dev/null
+++ b/dist/ssa/detections/illegal_account_creation_via_powersploit_modules.yml
@@ -0,0 +1,78 @@
+author: Stanislav Miskovic, Splunk
+datamodel: []
+date: '2020-11-09'
+description: This detection identifies access to PowerSploit modules that create accounts
+  illegaly.
+how_to_implement: You must be ingesting Windows Security logs from devices of interest,
+  including the event ID 4688 with enabled command line logging.
+id: 20fba62a-fa5b-46cc-b39f-473fa248fee2
+known_false_positives: None identified.
+name: Illegal Account Creation via PowerSploit modules
+product:
+- Splunk Behavioral Analytics
+references:
+- https://github.com/PowerShellMafia/PowerSploit
+risk_message: PowerSploit malware is creating illegal domain accounts. Operation is
+  performed at the device $dest_device_id$, by the account $dest_user_id$ via command
+  $cmd_line$
+search: '| from read_ssa_enriched_events()
+
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
+  "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
+  /(?i)New-DomainUser/)=true )
+
+  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
+  | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Windows Persistence Techniques
+  asset_type: Windows
+  cis20:
+  - CIS 16
+  - CIS 20
+  confidence: 100
+  context:
+  - Source:AD
+  - Source:Endpoint
+  - Stage:Persistence
+  - Consequence:Loss Of Control
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1585/illegal_account_creation/logAllPowerSploitModulesWithOldNames.log
+  impact: 80
+  kill_chain_phases:
+  - Actions on Objectives
+  message: PowerSploit malware is creating illegal domain accounts. Operation is performed
+    at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$
+  mitre_attack_id:
+  - T1585
+  nist:
+  - PR.AC
+  - PR.IP
+  observable:
+  - name: dest_user_id
+    role:
+    - Actor
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: cmd_line
+    role:
+    - Others
+    type: processname
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - dest_device_id
+  - dest_user_id
+  - process
+  - _time
+  risk_score: 80
+  risk_severity: high
+  security_domain: endpoint
+type: TTP
+version: 1
diff --git a/dist/ssa/detections/illegal_deletion_of_logs_via_mimikatz_modules.yml b/dist/ssa/detections/illegal_deletion_of_logs_via_mimikatz_modules.yml
new file mode 100644
index 0000000000..8dcad8203f
--- /dev/null
+++ b/dist/ssa/detections/illegal_deletion_of_logs_via_mimikatz_modules.yml
@@ -0,0 +1,79 @@
+author: Stanislav Miskovic, Splunk
+datamodel: []
+date: '2020-11-09'
+description: This detection identifies access to PowerSploit modules that delete event
+  logs.
+how_to_implement: You must be ingesting Windows Security logs from devices of interest,
+  including the event ID 4688 with enabled command line logging.
+id: 4ddb3b0d-f95f-4ae2-b4e8-663296453a7b
+known_false_positives: None identified.
+name: Illegal Deletion of Logs via Mimikatz modules
+product:
+- Splunk Behavioral Analytics
+references:
+- https://github.com/gentilkiwi/mimikatz
+risk_message: Mimikatz malware is deleting event logs to cover tracks of malicious
+  activity. Operation is performed at the device $dest_device_id$, by the account
+  $dest_user_id$ via command $cmd_line$
+search: '| from read_ssa_enriched_events()
+
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
+  "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
+  /(?i)event::drop/)=true OR match_regex(cmd_line, /(?i)event::clear/)=true )
+
+  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
+  | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Windows Log Manipulation
+  asset_type: Windows
+  cis20:
+  - CIS 16
+  - CIS 20
+  confidence: 100
+  context:
+  - Source:AD
+  - Source:Endpoint
+  - Stage:Command And Control
+  - Consequence:Loss Of Control
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070/illegal_log_deletion/logAllMimikatzModules.log
+  impact: 50
+  kill_chain_phases:
+  - Actions on Objectives
+  message: Mimikatz malware is deleting event logs to cover tracks of malicious activity.
+    Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
+    via command $cmd_line$
+  mitre_attack_id:
+  - T1070
+  nist:
+  - PR.AC
+  - PR.IP
+  observable:
+  - name: dest_user_id
+    role:
+    - Actor
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: cmd_line
+    role:
+    - Others
+    type: processname
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - dest_device_id
+  - dest_user_id
+  - process
+  - _time
+  risk_score: 50
+  risk_severity: medium
+  security_domain: endpoint
+type: TTP
+version: 1
diff --git a/dist/ssa/detections/illegal_enabling_or_disabling_of_accounts_via_dsinternals_modules.yml b/dist/ssa/detections/illegal_enabling_or_disabling_of_accounts_via_dsinternals_modules.yml
new file mode 100644
index 0000000000..30f260db39
--- /dev/null
+++ b/dist/ssa/detections/illegal_enabling_or_disabling_of_accounts_via_dsinternals_modules.yml
@@ -0,0 +1,81 @@
+author: Stanislav Miskovic, Splunk
+datamodel: []
+date: '2020-11-09'
+description: This detection identifies use of DSInternals modules that enable or disable
+  accounts illegaly.
+how_to_implement: You must be ingesting Windows Security logs from devices of interest,
+  including the event ID 4688 with enabled command line logging.
+id: 3e0f9962-9989-445f-878c-939443326b63
+known_false_positives: None identified.
+name: Illegal Enabling or Disabling of Accounts via DSInternals modules
+product:
+- Splunk Behavioral Analytics
+references:
+- https://github.com/MichaelGrafnetter/DSInternals
+risk_message: DSInternals malware is illegally enabling or disabling accounts. Operation
+  is performed at the device $dest_device_id$, by the account $dest_user_id$ via command
+  $cmd_line$
+search: '| from read_ssa_enriched_events()
+
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
+  "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
+  /(?i)Disable-ADDBAccount/)=true OR match_regex(cmd_line, /(?i)Enable-ADDBAccount/)=true
+  )
+
+  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
+  | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Windows Persistence Techniques
+  asset_type: Windows
+  cis20:
+  - CIS 16
+  - CIS 20
+  confidence: 100
+  context:
+  - Source:AD
+  - Source:Endpoint
+  - Stage:Command And Control
+  - Consequence:Loss Of Control
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllDSInternalsModules.log
+  impact: 80
+  kill_chain_phases:
+  - Actions on Objectives
+  message: DSInternals malware is illegally enabling or disabling accounts. Operation
+    is performed at the device $dest_device_id$, by the account $dest_user_id$ via
+    command $cmd_line$
+  mitre_attack_id:
+  - T1078
+  - T1098
+  nist:
+  - PR.AC
+  - PR.IP
+  observable:
+  - name: dest_user_id
+    role:
+    - Actor
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: cmd_line
+    role:
+    - Others
+    type: processname
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - dest_device_id
+  - dest_user_id
+  - process
+  - _time
+  risk_score: 80
+  risk_severity: high
+  security_domain: endpoint
+type: TTP
+version: 1
diff --git a/dist/ssa/detections/illegal_management_of_active_directory_elements_and_policies_via_dsinternals_modules.yml b/dist/ssa/detections/illegal_management_of_active_directory_elements_and_policies_via_dsinternals_modules.yml
new file mode 100644
index 0000000000..4f1020f197
--- /dev/null
+++ b/dist/ssa/detections/illegal_management_of_active_directory_elements_and_policies_via_dsinternals_modules.yml
@@ -0,0 +1,84 @@
+author: Stanislav Miskovic, Splunk
+datamodel: []
+date: '2020-11-09'
+description: This detection identifies use of DSInternals modules for illegal management
+  of Active Directoty elements and policies.
+how_to_implement: You must be ingesting Windows Security logs from devices of interest,
+  including the event ID 4688 with enabled command line logging.
+id: a587ca9f-c138-47b4-ba51-699f319b8cc5
+known_false_positives: None identified.
+name: Illegal Management of Active Directory Elements and Policies via DSInternals
+  modules
+product:
+- Splunk Behavioral Analytics
+references:
+- https://github.com/MichaelGrafnetter/DSInternals
+risk_message: DSInternals malware is controlling infrastructure by modifying Active
+  Directory elements, domain controllers, and policies. Operation is performed at
+  the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$
+search: '| from read_ssa_enriched_events()
+
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
+  "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
+  /(?i)Remove-ADDBObject/)=true OR match_regex(cmd_line, /(?i)Set-ADDBDomainController/)=true
+  OR match_regex(cmd_line, /(?i)Set-ADDBPrimaryGroup/)=true OR match_regex(cmd_line,
+  /(?i)Set-LsaPolicyInformation/)=true )
+
+  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
+  | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Windows Persistence Techniques
+  asset_type: Windows
+  cis20:
+  - CIS 16
+  - CIS 20
+  confidence: 100
+  context:
+  - Source:AD
+  - Source:Endpoint
+  - Stage:Command And Control
+  - Consequence:Loss Of Control
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484/logAllDSInternalsModules.log
+  impact: 90
+  kill_chain_phases:
+  - Actions on Objectives
+  message: DSInternals malware is controlling infrastructure by modifying Active Directory
+    elements, domain controllers, and policies. Operation is performed at the device
+    $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$
+  mitre_attack_id:
+  - T1098
+  - T1207
+  - T1484
+  nist:
+  - PR.AC
+  - PR.IP
+  observable:
+  - name: dest_user_id
+    role:
+    - Actor
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: cmd_line
+    role:
+    - Others
+    type: processname
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - dest_device_id
+  - dest_user_id
+  - process
+  - _time
+  risk_score: 90
+  risk_severity: high
+  security_domain: endpoint
+type: TTP
+version: 1
diff --git a/dist/ssa/detections/illegal_management_of_computers_and_active_directory_elements_via_powersploit_modules.yml b/dist/ssa/detections/illegal_management_of_computers_and_active_directory_elements_via_powersploit_modules.yml
new file mode 100644
index 0000000000..00a926ceea
--- /dev/null
+++ b/dist/ssa/detections/illegal_management_of_computers_and_active_directory_elements_via_powersploit_modules.yml
@@ -0,0 +1,85 @@
+author: Stanislav Miskovic, Splunk
+datamodel: []
+date: '2020-11-09'
+description: This detection identifies access to PowerSploit modules that enable illegal
+  management of computers and Active Directory elements.
+how_to_implement: You must be ingesting Windows Security logs from devices of interest,
+  including the event ID 4688 with enabled command line logging.
+id: 75760c11-7d48-4968-b828-013b299e8f6d
+known_false_positives: None identified.
+name: Illegal Management of Computers and Active Directory Elements via PowerSploit
+  modules
+product:
+- Splunk Behavioral Analytics
+references:
+- https://github.com/PowerShellMafia/PowerSploit
+risk_message: PowerSploit malware is controlling infrastructure by modifying Active
+  Directory elements or local Master Boot Records. Operation is performed at the device
+  $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$
+search: '| from read_ssa_enriched_events()
+
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
+  "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
+  /(?i)Set-DomainObject/)=true OR match_regex(cmd_line, /(?i)Set-ADObject/)=true OR
+  match_regex(cmd_line, /(?i)Set-DomainObjectOwner/)=true OR match_regex(cmd_line,
+  /(?i)Set-MasterBootRecord/)=true )
+
+
+  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
+  | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Windows Persistence Techniques
+  asset_type: Windows
+  cis20:
+  - CIS 16
+  - CIS 20
+  confidence: 100
+  context:
+  - Source:AD
+  - Source:Endpoint
+  - Stage:Command And Control
+  - Consequence:Loss Of Control
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484/logAllPowerSploitModulesWithOldNames.log
+  impact: 90
+  kill_chain_phases:
+  - Actions on Objectives
+  message: PowerSploit malware is controlling infrastructure by modifying Active Directory
+    elements or local Master Boot Records. Operation is performed at the device $dest_device_id$,
+    by the account $dest_user_id$ via command $cmd_line$
+  mitre_attack_id:
+  - T1098
+  - T1207
+  - T1484
+  nist:
+  - PR.AC
+  - PR.IP
+  observable:
+  - name: dest_user_id
+    role:
+    - Actor
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: cmd_line
+    role:
+    - Others
+    type: processname
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - dest_device_id
+  - dest_user_id
+  - process
+  - _time
+  risk_score: 90
+  risk_severity: high
+  security_domain: endpoint
+type: TTP
+version: 1
diff --git a/dist/ssa/detections/illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml b/dist/ssa/detections/illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml
new file mode 100644
index 0000000000..1fa9004a72
--- /dev/null
+++ b/dist/ssa/detections/illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml
@@ -0,0 +1,87 @@
+author: Stanislav Miskovic, Splunk
+datamodel: []
+date: '2020-11-09'
+description: This detection identifies access to PowerSploit modules that illegaly
+  elevate general privileges or ensure persistence, e.g., enable manipulation of registry,
+  task scheduling, persistent WMI, access to OS objects under desired identities.
+how_to_implement: You must be ingesting Windows Security logs from devices of interest,
+  including the event ID 4688 with enabled command line logging.
+id: 88c10ee9-fe72-4bce-b343-5b129044b991
+known_false_positives: None identified.
+name: Illegal Privilege Elevation and Persistence via PowerSploit modules
+product:
+- Splunk Behavioral Analytics
+references:
+- https://github.com/PowerShellMafia/PowerSploit
+risk_message: PowerSploit malware is planting attack persistence elements, altering
+  privileges and access controls. Operation is performed at the device $dest_device_id$,
+  by the account $dest_user_id$ via command $cmd_line$
+search: '| from read_ssa_enriched_events()
+
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
+  "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
+  /(?i)Add-DomainObjectAcl/)=true OR match_regex(cmd_line, /(?i)Add-ObjectAcl/)=true
+  OR match_regex(cmd_line, /(?i)Enable-Privilege/)=true OR match_regex(cmd_line, /(?i)New-ElevatedPersistenceOption/)=true
+  OR match_regex(cmd_line, /(?i)New-UserPersistenceOption/)=true )
+
+  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
+  | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Malicious PowerShell
+  - Windows Persistence Techniques
+  asset_type: Windows
+  cis20:
+  - CIS 16
+  - CIS 20
+  confidence: 100
+  context:
+  - Source:AD
+  - Source:Endpoint
+  - Stage:Privilege Escalation
+  - Stage:Command And Control
+  - Stage:Persistence
+  - Consequence:Loss Of Control
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/logAllPowerSploitModulesWithOldNames.log
+  impact: 90
+  kill_chain_phases:
+  - Actions on Objectives
+  message: PowerSploit malware is planting attack persistence elements, altering privileges
+    and access controls. Operation is performed at the device $dest_device_id$, by
+    the account $dest_user_id$ via command $cmd_line$
+  mitre_attack_id:
+  - T1053
+  - T1134
+  - T1548
+  nist:
+  - PR.AC
+  - PR.IP
+  observable:
+  - name: dest_user_id
+    role:
+    - Actor
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: cmd_line
+    role:
+    - Others
+    type: processname
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - dest_device_id
+  - dest_user_id
+  - process
+  - _time
+  risk_score: 90
+  risk_severity: high
+  security_domain: endpoint
+type: TTP
+version: 1
diff --git a/dist/ssa/detections/illegal_privilege_elevation_via_mimikatz_modules.yml b/dist/ssa/detections/illegal_privilege_elevation_via_mimikatz_modules.yml
new file mode 100644
index 0000000000..4983ffeeb3
--- /dev/null
+++ b/dist/ssa/detections/illegal_privilege_elevation_via_mimikatz_modules.yml
@@ -0,0 +1,82 @@
+author: Stanislav Miskovic, Splunk
+datamodel: []
+date: '2020-11-09'
+description: This detection identifies use of Mimikatz modules for illegal privilege
+  elevation.
+how_to_implement: You must be ingesting Windows Security logs from devices of interest,
+  including the event ID 4688 with enabled command line logging.
+id: 2f873b1f-6352-4844-b7b9-b419f09a42c7
+known_false_positives: None identified.
+name: Illegal Privilege Elevation via Mimikatz modules
+product:
+- Splunk Behavioral Analytics
+references:
+- https://github.com/gentilkiwi/mimikatz
+risk_message: Mimikatz malware is setting highest privileges to malicious entities.
+  Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
+  via command $cmd_line$
+search: '| from read_ssa_enriched_events()
+
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
+  "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
+  /(?i)privilege::debug/)=true OR match_regex(cmd_line, /(?i)token::elevate/)=true
+  )
+
+  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
+  | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Windows Privilege Escalation
+  asset_type: Windows
+  cis20:
+  - CIS 16
+  - CIS 20
+  confidence: 100
+  context:
+  - Source:AD
+  - Source:Endpoint
+  - Stage:Privilege Escalation
+  - Stage:Command And Control
+  - Consequence:Loss Of Control
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/logAllMimikatzModules.log
+  impact: 90
+  kill_chain_phases:
+  - Actions on Objectives
+  message: Mimikatz malware is setting highest privileges to malicious entities. Operation
+    is performed at the device $dest_device_id$, by the account $dest_user_id$ via
+    command $cmd_line$
+  mitre_attack_id:
+  - T1134
+  - T1548
+  nist:
+  - PR.AC
+  - PR.IP
+  observable:
+  - name: dest_user_id
+    role:
+    - Actor
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: cmd_line
+    role:
+    - Others
+    type: processname
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - dest_device_id
+  - dest_user_id
+  - process
+  - _time
+  risk_score: 90
+  risk_severity: high
+  security_domain: endpoint
+type: TTP
+version: 1
diff --git a/dist/ssa/detections/illegal_service_and_process_control_via_mimikatz_modules.yml b/dist/ssa/detections/illegal_service_and_process_control_via_mimikatz_modules.yml
new file mode 100644
index 0000000000..7a9d428326
--- /dev/null
+++ b/dist/ssa/detections/illegal_service_and_process_control_via_mimikatz_modules.yml
@@ -0,0 +1,84 @@
+author: Stanislav Miskovic, Splunk
+datamodel: []
+date: '2020-11-09'
+description: This detection identifies use of Mimikatz modules for illegal control
+  over services and processes, including the authentication service.
+how_to_implement: You must be ingesting Windows Security logs from devices of interest,
+  including the event ID 4688 with enabled command line logging.
+id: aaf3adf1-73e1-4477-b4ee-3771898964f1
+known_false_positives: None identified.
+name: Illegal Service and Process Control via Mimikatz modules
+product:
+- Splunk Behavioral Analytics
+references:
+- https://github.com/gentilkiwi/mimikatz
+risk_message: Mimikatz malware is controlling computer's processess and services.
+  Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
+  via command $cmd_line$
+search: '| from read_ssa_enriched_events()
+
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
+  "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
+  /(?i)process::start/)=true OR match_regex(cmd_line, /(?i)service::\+/)=true OR match_regex(cmd_line,
+  /(?i)service::\-/)=true OR match_regex(cmd_line, /(?i)service::start/)=true OR match_regex(cmd_line,
+  /(?i)service::stop/)=true OR match_regex(cmd_line, /(?i)service::suspend/)=true
+  OR match_regex(cmd_line, /(?i)misc::memssp/)=true )
+
+  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
+  | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Windows Service Abuse
+  asset_type: Windows
+  cis20:
+  - CIS 16
+  - CIS 20
+  confidence: 100
+  context:
+  - Source:AD
+  - Source:Endpoint
+  - Stage:Command And Control
+  - Consequence:Loss Of Control
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllMimikatzModules.log
+  impact: 90
+  kill_chain_phases:
+  - Actions on Objectives
+  message: Mimikatz malware is controlling computer's processess and services. Operation
+    is performed at the device $dest_device_id$, by the account $dest_user_id$ via
+    command $cmd_line$
+  mitre_attack_id:
+  - T1055
+  - T1106
+  - T1569
+  nist:
+  - PR.AC
+  - PR.IP
+  observable:
+  - name: dest_user_id
+    role:
+    - Actor
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: cmd_line
+    role:
+    - Others
+    type: processname
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - dest_device_id
+  - dest_user_id
+  - process
+  - _time
+  risk_score: 90
+  risk_severity: high
+  security_domain: endpoint
+type: TTP
+version: 1
diff --git a/dist/ssa/detections/illegal_service_and_process_control_via_powersploit_modules.yml b/dist/ssa/detections/illegal_service_and_process_control_via_powersploit_modules.yml
new file mode 100644
index 0000000000..e45c13be43
--- /dev/null
+++ b/dist/ssa/detections/illegal_service_and_process_control_via_powersploit_modules.yml
@@ -0,0 +1,94 @@
+author: Stanislav Miskovic, Splunk
+datamodel: []
+date: '2020-11-09'
+description: This detection identifies access to PowerSploit modules that enable illegal
+  control of services and processes, such as installing or spoofing of malicious services,
+  injecting malicious code in DLLs and EXEs, invoking shell code and WMI commands,
+  modifying access to service objects, etc.
+how_to_implement: You must be ingesting Windows Security logs from devices of interest,
+  including the event ID 4688 with enabled command line logging.
+id: 0e910e5b-309d-4bc3-8af2-0030c02aa353
+known_false_positives: None identified.
+name: Illegal Service and Process Control via PowerSploit modules
+product:
+- Splunk Behavioral Analytics
+references:
+- https://github.com/PowerShellMafia/PowerSploit
+risk_message: PowerSploit malware is controlling computer's processess and services.
+  Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
+  via command $cmd_line$
+search: '| from read_ssa_enriched_events()
+
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
+  "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
+  /(?i)Install-SSP/)=true OR match_regex(cmd_line, /(?i)Set-CriticalProcess/)=true
+  OR match_regex(cmd_line, /(?i)Install-ServiceBinary/)=true OR match_regex(cmd_line,
+  /(?i)Restore-ServiceBinary/)=true OR match_regex(cmd_line, /(?i)Write-ServiceBinary/)=true
+  OR match_regex(cmd_line, /(?i)Set-ServiceBinaryPath/)=true OR match_regex(cmd_line,
+  /(?i)Invoke-ReflectivePEInjection/)=true OR match_regex(cmd_line, /(?i)Invoke-DllInjection/)=true
+  OR match_regex(cmd_line, /(?i)Invoke-ServiceAbuse/)=true OR match_regex(cmd_line,
+  /(?i)Invoke-Shellcode/)=true OR match_regex(cmd_line, /(?i)Invoke-WScriptUACBypass/)=true
+  OR match_regex(cmd_line, /(?i)Invoke-WmiCommand/)=true OR match_regex(cmd_line,
+  /(?i)Write-HijackDll/)=true OR match_regex(cmd_line, /(?i)Add-ServiceDacl/)=true
+  )
+
+
+  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line])
+  | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Windows Service Abuse
+  - Malicious PowerShell
+  asset_type: Windows
+  cis20:
+  - CIS 16
+  - CIS 20
+  confidence: 100
+  context:
+  - Source:AD
+  - Source:Endpoint
+  - Stage:Recon
+  - Stage:Credential Access
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log
+  impact: 90
+  kill_chain_phases:
+  - Actions on Objectives
+  message: PowerSploit malware is controlling computer's processess and services.
+    Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
+    via command $cmd_line$
+  mitre_attack_id:
+  - T1055
+  - T1106
+  - T1569
+  nist:
+  - PR.AC
+  - PR.IP
+  observable:
+  - name: dest_user_id
+    role:
+    - Actor
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: cmd_line
+    role:
+    - Others
+    type: processname
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - dest_device_id
+  - dest_user_id
+  - process
+  - _time
+  risk_score: 90
+  risk_severity: high
+  security_domain: endpoint
+type: TTP
+version: 1
diff --git a/dist/ssa/detections/modify_acls_permission_of_files_or_folders.yml b/dist/ssa/detections/modify_acls_permission_of_files_or_folders.yml
new file mode 100644
index 0000000000..a1fefe4fba
--- /dev/null
+++ b/dist/ssa/detections/modify_acls_permission_of_files_or_folders.yml
@@ -0,0 +1,77 @@
+author: Teoderick Contreras, Splunk
+datamodel:
+- Endpoint
+date: '2021-06-15'
+description: This analytic identifies suspicious modification of ACL permission to
+  a files or folder to make it available to everyone or to a specific user. This technique
+  may be used by the adversary to evade ACLs or protected files access. This changes
+  is commonly configured by the file or directory owner with appropriate permission.
+  This behavior is a good indicator if this command seen on a machine utilized by
+  an account with no permission to do so.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed cacls.exe may be used.
+id: 9ae9a48a-cdbe-11eb-875a-acde48001122
+known_false_positives: network administrator may use this windows utility. filter
+  is needed.
+name: Modify ACLs Permission Of Files Or Folders
+product:
+- Splunk Behavioral Analytics
+references:
+- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
+risk_message: A cacls process $process_name$ with commandline $cmd_line$ try to modify
+  a permission of a file or directory in host $dest_device_id$
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
+  null), process_name=ucast(map_get(input_event, "process_name"), "string", null),
+  process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event,
+  "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"),
+  "string", null) | where cmd_line IS NOT NULL AND like(cmd_line, "%/G%") AND (match_regex(cmd_line,
+  /(?i)everyone:/)=true OR match_regex(cmd_line, /(?i)SYSTEM:/)=true) AND (process_name="cacls.exe"
+  OR process_name="xcacls.exe" OR process_name="icacls.exe") | eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
+  body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
+  "parent_process_name", parent_process_name, "process_path", process_path]) | into
+  write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - XMRig
+  confidence: 70
+  context:
+  - source:endpoint
+  - stage: Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log
+  impact: 50
+  kill_chain_phases:
+  - Exploitation
+  message: A cacls process $process_name$ with commandline $cmd_line$ try to modify
+    a permission of a file or directory in host $dest_device_id$
+  mitre_attack_id:
+  - T1222
+  observable:
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: dest_user_id
+    role:
+    - Victim
+    type: user
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  risk_score: 35
+  risk_severity: medium
+  security_domain: endpoint
+type: Anomaly
+version: 1
diff --git a/dist/ssa/detections/more_than_usual_number_of_lolbas_applications_in_short_time_period.yml b/dist/ssa/detections/more_than_usual_number_of_lolbas_applications_in_short_time_period.yml
new file mode 100644
index 0000000000..b0ce976cf1
--- /dev/null
+++ b/dist/ssa/detections/more_than_usual_number_of_lolbas_applications_in_short_time_period.yml
@@ -0,0 +1,94 @@
+author: Ignacio Bermudez Corrales, Splunk
+datamodel: []
+date: '2020-08-25'
+description: Attacker activity may compromise executing several LOLBAS applications
+  in conjunction to accomplish their objectives. We are looking for more than usual
+  LOLBAS applications over a window of time, by building profiles per machine.
+how_to_implement: Collect endpoint data such as sysmon or 4688 events.
+id: 59c0dd70-169c-4900-9a1f-bfcf13302f93
+known_false_positives: 'Some administrative tasks may involve multiple use of LOLBAS
+  applications in a short period of time. This might trigger false positives at the
+  beginning when it hasn''t collected yet enough data to construct the baseline.
+
+  '
+name: More than usual number of LOLBAS applications in short time period
+product:
+- Splunk Behavioral Analytics
+references:
+- https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries
+risk_message: A system process $process_name$ with commandline $cmd_line$ spawn iin
+  short period of time in host $dest_device_id$
+search: ' | from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
+  "dest_device_id"), "string", null), process_name=lower(ucast(map_get(input_event,
+  "process_name"), "string", null)), timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)) | where process_name=="regsvcs.exe" OR process_name=="ftp.exe"
+  OR process_name=="dfsvc.exe" OR process_name=="rasautou.exe" OR process_name=="schtasks.exe"
+  OR process_name=="xwizard.exe" OR process_name=="findstr.exe" OR process_name=="esentutl.exe"
+  OR process_name=="cscript.exe" OR process_name=="reg.exe" OR process_name=="csc.exe"
+  OR process_name=="atbroker.exe" OR process_name=="print.exe" OR process_name=="pcwrun.exe"
+  OR process_name=="vbc.exe" OR process_name=="rpcping.exe" OR process_name=="wsreset.exe"
+  OR process_name=="ilasm.exe" OR process_name=="certutil.exe" OR process_name=="replace.exe"
+  OR process_name=="mshta.exe" OR process_name=="bitsadmin.exe" OR process_name=="wscript.exe"
+  OR process_name=="ieexec.exe" OR process_name=="cmd.exe" OR process_name=="microsoft.workflow.compiler.exe"
+  OR process_name=="runscripthelper.exe" OR process_name=="makecab.exe" OR process_name=="forfiles.exe"
+  OR process_name=="desktopimgdownldr.exe" OR process_name=="control.exe" OR process_name=="msbuild.exe"
+  OR process_name=="register-cimprovider.exe" OR process_name=="tttracer.exe" OR process_name=="ie4uinit.exe"
+  OR process_name=="sc.exe" OR process_name=="bash.exe" OR process_name=="hh.exe"
+  OR process_name=="cmstp.exe" OR process_name=="mmc.exe" OR process_name=="jsc.exe"
+  OR process_name=="scriptrunner.exe" OR process_name=="odbcconf.exe" OR process_name=="extexport.exe"
+  OR process_name=="msdt.exe" OR process_name=="diskshadow.exe" OR process_name=="extrac32.exe"
+  OR process_name=="eventvwr.exe" OR process_name=="mavinject.exe" OR process_name=="regasm.exe"
+  OR process_name=="gpscript.exe" OR process_name=="rundll32.exe" OR process_name=="regsvr32.exe"
+  OR process_name=="regedit.exe" OR process_name=="msiexec.exe" OR process_name=="gfxdownloadwrapper.exe"
+  OR process_name=="presentationhost.exe" OR process_name=="regini.exe" OR process_name=="wmic.exe"
+  OR process_name=="runonce.exe" OR process_name=="syncappvpublishingserver.exe" OR
+  process_name=="verclsid.exe" OR process_name=="psr.exe" OR process_name=="infdefaultinstall.exe"
+  OR process_name=="explorer.exe" OR process_name=="expand.exe" OR process_name=="installutil.exe"
+  OR process_name=="netsh.exe" OR process_name=="wab.exe" OR process_name=="dnscmd.exe"
+  OR process_name=="at.exe" OR process_name=="pcalua.exe" OR process_name=="cmdkey.exe"
+  OR process_name=="msconfig.exe" | stats count(process_name) as lolbas_counter by
+  device,span(timestamp, 300s) | eval lolbas_counter=lolbas_counter*1.0 | rename window_end
+  as timestamp | adaptive_threshold algorithm="quantile" value="lolbas_counter" entity="device"
+  window=2419200000L | where label AND quantile>0.99 | eval start_time = window_start,
+  end_time = timestamp, entities = mvappend(device), body=create_map(["lolbas_counter",
+  lolbas_counter, "quantile", quantile, "device", device]) | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Unusual Processes
+  cis20:
+  - CIS 8
+  confidence: 50
+  context:
+  - source:endpoint
+  - stage: Defense Evasion
+  impact: 50
+  kill_chain_phases:
+  - Exploitation
+  message: A system process $process_name$ with commandline $cmd_line$ spawn iin short
+    period of time in host $dest_device_id$
+  mitre_attack_id:
+  - T1059
+  - T1053
+  nist:
+  - PR.PT
+  - DE.CM
+  observable:
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: process_name
+    role:
+    - Others
+    type: processname
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - dest_device_id
+  - _time
+  - process_name
+  risk_score: 25
+  risk_severity: medium
+  security_domain: endpoint
+type: Anomaly
+version: 2
diff --git a/dist/ssa/detections/phishing_email_detection_by_machine_learning_method_-_ssa.yml b/dist/ssa/detections/phishing_email_detection_by_machine_learning_method_-_ssa.yml
new file mode 100644
index 0000000000..c1f2707376
--- /dev/null
+++ b/dist/ssa/detections/phishing_email_detection_by_machine_learning_method_-_ssa.yml
@@ -0,0 +1,62 @@
+author: Xiao Lin, Splunk
+datamodel: []
+date: '2020-08-25'
+description: Malicious mails can conduct phishing that induces readers to open attachment,
+  click links or trigger third party service. This detect uses Natural Language Processing
+  (NLP) approach to analyze an email message's content (Sender, Subject and Body)
+  and judge whether it is a phishing email. The detection adopts a deep learning (neural
+  network) model that employs character level embeddings plus LSTM layers to perform
+  classification. The model is pre-trained and then published as ONNX format. Current
+  sample model is trained using the dataset published at https://github.com/splunk/attack_data/tree/master/datasets/T1566_Phishing_Email/splunk_train.json
+  User are expected to re-train the model by combining with their own training data
+  for better accuracy using the provided model file (SMLE notebook). DSP pipeline
+  then processes the email message and passes it as an event to Apply ML Models function,
+  which returns the probability of a phishing email. Current implementation assumes
+  the email is fed to DSP in JSON format contains at least email's sender, subject
+  and its message body, including reply content, if any.
+how_to_implement: Events are fed to DSP contains at least email's sender, subject
+  and its message body.
+id: 4b237388-dfa1-41a6-91d4-4de2d598376f
+known_false_positives: Because of imbalance of anomaly data in training, the model
+  will less likely report false positive. Instead, the model is more prone to false
+  negative. Current best recall score is ~85%
+name: Phishing Email Detection by Machine Learning Method - SSA
+product:
+- Splunk Behavioral Analytics
+references: []
+search: '| from read_ssa_enriched_events() | eval eventLine=concat(ucast(map_get(input_event,
+  "From"), "string", " "), " ", ucast(map_get(input_event, "Subject"), "string", "
+  "), " ", ucast(map_get(input_event, "Content"), "string", " "), "                                                                                                                                "),
+  _time=map_get(input_event, "_time") | where eventLine IS NOT NULL | eval mapC={"
+  ": 32, "!": 33, "\"": 34, "#": 35, "$": 36, "%": 37, "&": 38, "`": 39, "(": 40,
+  ")": 41, "*": 42, "+": 43, ",": 44, "-": 45, ".": 46, "/": 47, "0": 48, "1": 49,
+  "2": 50, "3": 51, "4": 52, "5": 53, "6": 54, "7": 55, "8": 56, "9": 57, ":": 58,
+  ";": 59, "<": 60, "=": 61, ">": 62, "?": 63, "@": 64, "A": 65, "B": 66, "C": 67,
+  "D": 68, "E": 69, "F": 70, "G": 71, "H": 72, "I": 73, "J": 74, "K": 75, "L": 76,
+  "M": 77, "N": 78, "O": 79, "P": 80, "Q": 81, "R": 82, "S": 83, "T": 84, "U": 85,
+  "V": 86, "W": 87, "X": 88, "Y": 89, "Z": 90, "[": 91, "\\": 92, "]": 93, "^": 94,
+  "_": 95, "`": 96, "a": 97, "b": 98, "c": 99, "d": 100, "e": 101, "f": 102, "g":
+  103, "h": 104, "i": 105, "j": 106, "k": 107, "l": 108, "m": 109, "n": 110, "o":
+  111, "p": 112, "q": 113, "r": 114, "s": 115, "t": 116, "u": 117, "v": 118, "w":
+  119, "x": 120, "y": 121, "z": 122, "{": 123, "|": 124, "}": 125, "~": 126}, ml_in
+  = for_each(iterator(mvrange(1,129), "i"), cast(map_get(mapC, substr(eventLine, i,
+  1)), "float") ) | apply_model connection_id="YOUR_S3_ONNX_CONNECTOR_ID" name="phishing_email_v8"
+  path="s3://smle-experiments/models/phishing_email" | eval probability = mvindex(ml_out,
+  0) | where probability > 0.5 | eval start_time=_time, end_time=_time, entities="TBD",
+  body="TBD" | select probability, body, entities, start_time, end_time | into write_ssa_detected_events();'
+tags:
+  cis20:
+  - CIS 8
+  kill_chain_phases:
+  - Actions on Objectives
+  mitre_attack_id:
+  - T1566
+  nist:
+  - PR.PT
+  - DE.CM
+  product:
+  - Splunk Behavioral Analytics
+  risk_severity: low
+  security_domain: mail server
+type: Anomaly
+version: 1
diff --git a/dist/ssa/detections/potential_pass_the_token_or_hash_observed_at_the_destination_device.yml b/dist/ssa/detections/potential_pass_the_token_or_hash_observed_at_the_destination_device.yml
new file mode 100644
index 0000000000..152216867c
--- /dev/null
+++ b/dist/ssa/detections/potential_pass_the_token_or_hash_observed_at_the_destination_device.yml
@@ -0,0 +1,98 @@
+author: Stanislav Miskovic, Splunk
+datamodel: []
+date: '2021-09-01'
+description: This detection identifies potential Pass the Token or Pass the Hash credential
+  exploits. We detect the main side effect of these attacks, which is a transition
+  from the dominant Kerberos logins to rare NTLM logins for a given user, as reported
+  by a detination device.
+how_to_implement: You must be ingesting Windows Security logs from endpoint devices,
+  i.e., destinations of interest. Please make sure that event ID 4624 is being logged.
+id: 82e76b80-5cdb-4899-9b43-85dbe777b36d
+known_false_positives: Environments in which NTLM is used extremely rarely and for
+  benign purposes (such as a rare use of SMB shares).
+name: Potential Pass the Token or Hash Observed at the Destination Device
+product:
+- Splunk Behavioral Analytics
+references:
+- https://attack.mitre.org/techniques/T1550/002/
+risk_message: Potential lateral movement and credential stealing via Pass the Token
+  or Pass the Hash techniques. Operation is performed via credentials of the account
+  $dest_user_id$ and observed by the destination device $dest_device_id$
+search: '| from read_ssa_enriched_events() | eval timestamp=      parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), dest_user=      lower(ucast(map_get(input_event, "dest_user_primary_artifact"),
+  "string", null)), dest_user_id=   lower(ucast(map_get(input_event, "dest_user_id"),
+  "string", null)), dest_device_id=       lower(ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), signature_id=   lower(ucast(map_get(input_event, "signature_id"),
+  "string", null)), authentication_method=  lower(ucast(map_get(input_event, "authentication_method"),
+  "string", null))
+
+  | where signature_id = "4624" AND (authentication_method="ntlmssp" OR authentication_method="kerberos")
+  AND dest_user_id != null AND dest_device_id != null
+
+  | eval isKerberos=if(authentication_method == "kerberos", 1, 0), isNtlm=if(authentication_method
+  == "ntlmssp", 1, 0), timeNTLM=if(isNtlm > 0, timestamp, null)
+
+  | stats sum(isKerberos) as totalKerberos, sum(isNtlm)     as totalNtlm, min(timestamp)  as
+  startTime, min(timeNTLM)   as startNTLMTime, max(timestamp)  as endTime, max(timeNTLM)   as
+  endNTLMTime by dest_user_id, dest_user, dest_device_id, span(timestamp, 86400s)
+
+  | where NOT dest_user="-" AND totalKerberos > 0 AND totalNtlm > 0 AND endTime -
+  startTime > 1800000 AND (totalKerberos > 10 * totalNtlm AND totalKerberos > 50)  AND
+  (endTime - startTime) > 3 * (endNTLMTime - startNTLMTime)
+
+  | eval start_time=ucast(startNTLMTime, "long", null), end_time=ucast(endNTLMTime,
+  "long", null), entities=mvappend(dest_user_id, dest_device_id), body=create_map(["total_kerberos",
+  totalKerberos, "total_ntlm", totalNtlm, "analysis_start_time", startTime, "analysis_end_time",
+  endTime, "pth_start_time", startNTLMTime, "pth_end_time", endNTLMTime])
+
+  | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Lateral Movement
+  asset_type: Windows
+  cis20:
+  - CIS 16
+  - CIS 20
+  confidence: 90
+  context:
+  - Source:AD
+  - Source:Endpoint
+  - Stage:Credential Access
+  - Stage:Lateral Movement
+  impact: 80
+  kill_chain_phases:
+  - Lateral Movement
+  message: Potential lateral movement and credential stealing via Pass the Token or
+    Pass the Hash techniques. Operation is performed via credentials of the account
+    $dest_user_id$ and observed by the destination device $dest_device_id$
+  mitre_attack_id:
+  - T1550
+  - T1550.002
+  nist:
+  - PR.PT
+  - PR.AT
+  - PR.AC
+  - PR.IP
+  observable:
+  - name: dest_user_id
+    role:
+    - Actor
+    type: User
+  - name: dest_device_id
+    role:
+    - Other
+    type: Hostname
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - signature_id
+  - dest_user
+  - dest_user_id
+  - dest_device_id
+  - authentication_method
+  risk_score: 72
+  risk_severity: low
+  security_domain: endpoint
+type: TTP
+version: 1
diff --git a/dist/ssa/detections/potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml b/dist/ssa/detections/potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml
new file mode 100644
index 0000000000..e35cde279a
--- /dev/null
+++ b/dist/ssa/detections/potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml
@@ -0,0 +1,100 @@
+author: Stanislav Miskovic, Splunk
+datamodel: []
+date: '2021-09-01'
+description: This detection identifies potential Pass the Token or Pass the Hash credential
+  exploits. We detect the main side effect of these attacks, which is a transition
+  from the dominant Kerberos logins to rare NTLM logins for a given user, as reported
+  by an event-collecting device (i.e., a specific domain controller or an endpoint
+  destination).
+how_to_implement: You must be ingesting Windows Security logs from devices of interest
+  - at least from domain controllers. Please make sure that event ID 4624 is being
+  logged.
+id: 1058ba3e-a698-49bc-a1e5-7cedece4ea87
+known_false_positives: Environments in which NTLM is used extremely rarely and for
+  benign purposes (such as a rare use of SMB shares).
+name: Potential Pass the Token or Hash Observed by an Event Collecting Device
+product:
+- Splunk Behavioral Analytics
+references:
+- https://attack.mitre.org/techniques/T1550/002/
+risk_message: Potential lateral movement and credential stealing via Pass the Token
+  or Pass the Hash techniques. Operation is performed via credentials of the account
+  $dest_user_id$ and observed by the logging device $origin_device_id$
+search: '| from read_ssa_enriched_events() | eval timestamp=      parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), dest_user=      lower(ucast(map_get(input_event, "dest_user_primary_artifact"),
+  "string", null)), dest_user_id=   lower(ucast(map_get(input_event, "dest_user_id"),
+  "string", null)), origin_device_id=       lower(ucast(map_get(input_event, "origin_device_id"),
+  "string", null)), signature_id=   lower(ucast(map_get(input_event, "signature_id"),
+  "string", null)), authentication_method=  lower(ucast(map_get(input_event, "authentication_method"),
+  "string", null))
+
+  | where signature_id = "4624" AND (authentication_method="ntlmssp" OR authentication_method="kerberos")
+  AND dest_user_id != null AND origin_device_id != null
+
+  | eval isKerberos=if(authentication_method == "kerberos", 1, 0), isNtlm=if(authentication_method
+  == "ntlmssp", 1, 0), timeNTLM=if(isNtlm > 0, timestamp, null)
+
+  | stats sum(isKerberos) as totalKerberos, sum(isNtlm)     as totalNtlm, min(timestamp)  as
+  startTime, min(timeNTLM)   as startNTLMTime, max(timestamp)  as endTime, max(timeNTLM)   as
+  endNTLMTime by dest_user_id, dest_user, origin_device_id, span(timestamp, 86400s)
+
+  | where NOT dest_user="-" AND totalKerberos > 0 AND totalNtlm > 0 AND endTime -
+  startTime > 1800000 AND (totalKerberos > 10 * totalNtlm AND totalKerberos > 50)  AND
+  (endTime - startTime) > 3 * (endNTLMTime - startNTLMTime)
+
+  | eval start_time=startNTLMTime, end_time=endNTLMTime, entities=mvappend(dest_user_id,
+  origin_device_id), body=create_map(["total_kerberos", totalKerberos, "total_ntlm",
+  totalNtlm, "analysis_start_time", startTime, "analysis_end_time", endTime, "detection_start_time",
+  startNTLMTime, "detection_end_time", endNTLMTime])
+
+  | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Lateral Movement
+  asset_type: Windows
+  cis20:
+  - CIS 16
+  - CIS 20
+  confidence: 80
+  context:
+  - Source:AD
+  - Source:Endpoint
+  - Stage:Credential Access
+  - Stage:Lateral Movement
+  impact: 80
+  kill_chain_phases:
+  - Lateral Movement
+  message: Potential lateral movement and credential stealing via Pass the Token or
+    Pass the Hash techniques. Operation is performed via credentials of the account
+    $dest_user_id$ and observed by the logging device $origin_device_id$
+  mitre_attack_id:
+  - T1550
+  - T1550.002
+  nist:
+  - PR.PT
+  - PR.AT
+  - PR.AC
+  - PR.IP
+  observable:
+  - name: dest_user_id
+    role:
+    - Actor
+    type: User
+  - name: origin_device_id
+    role:
+    - Other
+    type: Hostname
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - signature_id
+  - dest_user
+  - dest_user_id
+  - origin_device_id
+  - authentication_method
+  risk_score: 64
+  risk_severity: low
+  security_domain: endpoint
+type: TTP
+version: 1
diff --git a/dist/ssa/detections/probing_access_with_stolen_credentials_via_powersploit_modules.yml b/dist/ssa/detections/probing_access_with_stolen_credentials_via_powersploit_modules.yml
new file mode 100644
index 0000000000..0ca07c65e5
--- /dev/null
+++ b/dist/ssa/detections/probing_access_with_stolen_credentials_via_powersploit_modules.yml
@@ -0,0 +1,79 @@
+author: Stanislav Miskovic, Splunk
+datamodel: []
+date: '2020-11-04'
+description: This detection identifies use of PowerSploit modules that facilitate
+  access probing with admin credentials as well as probing access to system services.
+how_to_implement: You must be ingesting Windows Security logs from devices of interest,
+  including the event ID 4688 with enabled command line logging.
+id: d405af5d-99f1-45af-8dfb-b8f98b764247
+known_false_positives: None identified.
+name: Probing Access with Stolen Credentials via PowerSploit modules
+product:
+- Splunk Behavioral Analytics
+references:
+- https://github.com/PowerShellMafia/PowerSploit
+risk_message: PowerSploit malware is probing access with stolen credentials. Operation
+  is performed at the device $dest_device_id$, by the account $dest_user_id$ via command
+  $cmd_line$
+search: '| from read_ssa_enriched_events()
+
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
+  "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
+  /(?i)Test-AdminAccess/)=true OR match_regex(cmd_line, /(?i)Invoke-CheckLocalAdminAccess/)=true
+  OR match_regex(cmd_line, /(?i)Test-ServiceDaclPermission/)=true )
+
+  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line])
+  | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Windows Privilege Escalation
+  asset_type: Windows
+  cis20:
+  - CIS 16
+  - CIS 20
+  confidence: 100
+  context:
+  - Source:AD
+  - Source:Endpoint
+  - Stage:Recon
+  - Stage:Credential Access
+  impact: 60
+  kill_chain_phases:
+  - Actions on Objectives
+  message: PowerSploit malware is probing access with stolen credentials. Operation
+    is performed at the device $dest_device_id$, by the account $dest_user_id$ via
+    command $cmd_line$
+  mitre_attack_id:
+  - T1078
+  - T1098
+  nist:
+  - PR.AC
+  - PR.IP
+  observable:
+  - name: dest_user_id
+    role:
+    - Actor
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: cmd_line
+    role:
+    - Others
+    type: processname
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - process
+  - dest_user_id
+  - dest_device_id
+  risk_score: 60
+  risk_severity: low
+  security_domain: endpoint
+type: TTP
+version: 1
diff --git a/dist/ssa/detections/rare_parent-child_process_relationship.yml b/dist/ssa/detections/rare_parent-child_process_relationship.yml
new file mode 100644
index 0000000000..89c0d48501
--- /dev/null
+++ b/dist/ssa/detections/rare_parent-child_process_relationship.yml
@@ -0,0 +1,87 @@
+author: Peter Gael, Splunk; Ignacio Bermudez Corrales, Splunk
+datamodel: []
+date: '2021-05-20'
+description: An attacker may use LOLBAS tools spawned from vulnerable applications
+  not typically used by system administrators. This search leverages the Splunk Streaming
+  ML DSP plugin to find rare parent/child relationships. The list of application has
+  been extracted from https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries
+how_to_implement: Collect endpoint data such as sysmon or 4688 events.
+id: cf090c78-bcc6-11eb-8529-0242ac130003
+known_false_positives: 'Some custom tools used by admins could be used rarely to launch
+  remotely applications. This might trigger false positives at the beginning when
+  it hasn''t collected yet enough data to construct the baseline.
+
+  '
+name: Rare Parent-Child Process Relationship
+product:
+- Splunk Behavioral Analytics
+references: []
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)) | eval parent_process=lower(ucast(map_get(input_event,
+  "parent_process_name"), "string", null)), parent_process_name=mvindex(split(parent_process,
+  "\\"), -1), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
+  null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), dest_user_id=ucast(map_get(input_event,
+  "dest_user_id"), "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"),
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where parent_process_name!=null | select parent_process_name, process_name, cmd_line,
+  timestamp, dest_device_id, dest_user_id | conditional_anomaly conditional="parent_process_name"
+  target="process_name" | where (process_name="powershell.exe" OR process_name="regsvcs.exe"
+  OR process_name="ftp.exe" OR process_name="dfsvc.exe" OR process_name="rasautou.exe"
+  OR process_name="schtasks.exe" OR process_name="xwizard.exe" OR process_name="findstr.exe"
+  OR process_name="esentutl.exe" OR process_name="cscript.exe" OR process_name="reg.exe"
+  OR process_name="csc.exe" OR process_name="atbroker.exe" OR process_name="print.exe"
+  OR process_name="pcwrun.exe" OR process_name="vbc.exe" OR process_name="rpcping.exe"
+  OR process_name="wsreset.exe" OR process_name="ilasm.exe" OR process_name="certutil.exe"
+  OR process_name="replace.exe" OR process_name="mshta.exe" OR process_name="bitsadmin.exe"
+  OR process_name="wscript.exe" OR process_name="ieexec.exe" OR process_name="cmd.exe"
+  OR process_name="microsoft.workflow.compiler.exe" OR process_name="runscripthelper.exe"
+  OR process_name="makecab.exe" OR process_name="forfiles.exe" OR process_name="desktopimgdownldr.exe"
+  OR process_name="control.exe" OR process_name="msbuild.exe" OR process_name="register-cimprovider.exe"
+  OR process_name="tttracer.exe" OR process_name="ie4uinit.exe" OR process_name="sc.exe"
+  OR process_name="bash.exe" OR process_name="hh.exe" OR process_name="cmstp.exe"
+  OR process_name="mmc.exe" OR process_name="jsc.exe" OR process_name="scriptrunner.exe"
+  OR process_name="odbcconf.exe" OR process_name="extexport.exe" OR process_name="msdt.exe"
+  OR process_name="diskshadow.exe" OR process_name="extrac32.exe" OR process_name="eventvwr.exe"
+  OR process_name="mavinject.exe" OR process_name="regasm.exe" OR process_name="gpscript.exe"
+  OR process_name="rundll32.exe" OR process_name="regsvr32.exe" OR process_name="regedit.exe"
+  OR process_name="msiexec.exe" OR process_name="gfxdownloadwrapper.exe" OR process_name="presentationhost.exe"
+  OR process_name="regini.exe" OR process_name="wmic.exe" OR process_name="runonce.exe"
+  OR process_name="syncappvpublishingserver.exe" OR process_name="verclsid.exe" OR
+  process_name="psr.exe" OR process_name="infdefaultinstall.exe" OR process_name="explorer.exe"
+  OR process_name="expand.exe" OR process_name="installutil.exe" OR process_name="netsh.exe"
+  OR process_name="wab.exe" OR process_name="dnscmd.exe" OR process_name="at.exe"
+  OR process_name="pcalua.exe" OR process_name="cmdkey.exe" OR process_name="msconfig.exe")
+  | eval input = (-1)*log(output) | adaptive_threshold algorithm="gaussian" threshold=0.001
+  window=604800000L | where label AND input > mean | eval start_time = timestamp,
+  end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body =
+  create_map(["process_name", process_name, "parent_process_name", parent_process_name,
+  "input", input, "mean", mean, "variance", variance, "output", output, "cmd_line",
+  cmd_line]) | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Unusual Processes
+  cis20:
+  - CIS 8
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1203
+  - T1059
+  - T1053
+  - T1072
+  nist:
+  - PR.PT
+  - DE.CM
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - process
+  - process_name
+  - parent_process_name
+  - _time
+  - dest_device_id
+  - dest_user_id
+  risk_severity: low
+  security_domain: endpoint
+type: Anomaly
+version: 1
diff --git a/dist/ssa/detections/reconnaissance_and_access_to_accounts_and_groups_via_mimikatz_modules.yml b/dist/ssa/detections/reconnaissance_and_access_to_accounts_and_groups_via_mimikatz_modules.yml
new file mode 100644
index 0000000000..31f619c600
--- /dev/null
+++ b/dist/ssa/detections/reconnaissance_and_access_to_accounts_and_groups_via_mimikatz_modules.yml
@@ -0,0 +1,80 @@
+author: Stanislav Miskovic, Splunk
+datamodel: []
+date: '2020-11-05'
+description: This detection identifies use of Mimikatz modules for discovery of accounts
+  and groups and access to them.
+how_to_implement: You must be ingesting Windows Security logs from devices of interest,
+  including the event ID 4688 with enabled command line logging.
+id: 1bce67aa-3fc4-4886-9089-67f0bfebbef6
+known_false_positives: None identified.
+name: Reconnaissance and Access to Accounts and Groups via Mimikatz modules
+product:
+- Splunk Behavioral Analytics
+references:
+- https://github.com/gentilkiwi/mimikatz
+risk_message: Mimikatz malware is searching for and using specific accounts and groups.
+  Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
+  via command $cmd_line$
+search: '| from read_ssa_enriched_events()
+
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
+  "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
+  /(?i)net::user/)=true OR match_regex(cmd_line, /(?i)net::group/)=true )
+
+  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line])
+  | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Windows Discovery Techniques
+  asset_type: Windows
+  cis20:
+  - CIS 16
+  - CIS 20
+  confidence: 100
+  context:
+  - Source:AD
+  - Source:Endpoint
+  - Stage:Recon
+  - Stage:Command And Control
+  - Consequence:Loss Of Control
+  impact: 80
+  kill_chain_phases:
+  - Actions on Objectives
+  message: Mimikatz malware is searching for and using specific accounts and groups.
+    Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
+    via command $cmd_line$
+  mitre_attack_id:
+  - T1078
+  - T1087
+  - T1484
+  nist:
+  - PR.AC
+  - PR.IP
+  observable:
+  - name: dest_user_id
+    role:
+    - Actor
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: cmd_line
+    role:
+    - Others
+    type: processname
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - process
+  - dest_device_id
+  - dest_user_id
+  risk_score: 80
+  risk_severity: high
+  security_domain: endpoint
+type: TTP
+version: 1
diff --git a/dist/ssa/detections/reconnaissance_and_access_to_accounts_groups_and_policies_via_powersploit_modules.yml b/dist/ssa/detections/reconnaissance_and_access_to_accounts_groups_and_policies_via_powersploit_modules.yml
new file mode 100644
index 0000000000..92228f1f00
--- /dev/null
+++ b/dist/ssa/detections/reconnaissance_and_access_to_accounts_groups_and_policies_via_powersploit_modules.yml
@@ -0,0 +1,104 @@
+author: Stanislav Miskovic, Splunk
+datamodel: []
+date: '2020-11-05'
+description: This detection identifies access to PowerSploit modules that discover
+  accounts, groups and policies that can be accessed or taken over.
+how_to_implement: You must be ingesting Windows Security logs from devices of interest,
+  including the event ID 4688 with enabled command line logging.
+id: 63422f8e-766c-468f-8133-2ba6795e263b
+known_false_positives: None identified.
+name: Reconnaissance and Access to Accounts Groups and Policies via PowerSploit modules
+product:
+- Splunk Behavioral Analytics
+references:
+- https://github.com/PowerShellMafia/PowerSploit
+risk_message: PowerSploit malware is searching for and using specific accounts, groups
+  and policies, such as the last logged on account, a local Net group, etc. Operation
+  is performed at the device $dest_device_id$, by the account $dest_user_id$ via command
+  $cmd_line$
+search: '| from read_ssa_enriched_events()
+
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
+  "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
+  /(?i)Find-DomainLocalGroupMember/)=true OR match_regex(cmd_line, /(?i)Invoke-EnumerateLocalAdmin/)=true
+  OR match_regex(cmd_line, /(?i)Find-DomainUserEvent/)=true OR match_regex(cmd_line,
+  /(?i)Invoke-EventHunter/)=true OR match_regex(cmd_line, /(?i)Find-DomainUserLocation/)=true
+  OR match_regex(cmd_line, /(?i)Invoke-UserHunter/)=true OR match_regex(cmd_line,
+  /(?i)Get-DomainForeignGroupMember/)=true OR match_regex(cmd_line, /(?i)Find-ForeignGroup/)=true
+  OR match_regex(cmd_line, /(?i)Get-DomainForeignUser/)=true OR match_regex(cmd_line,
+  /(?i)Find-ForeignUser/)=true OR match_regex(cmd_line, /(?i)Get-DomainGPO/)=true
+  OR match_regex(cmd_line, /(?i)Get-NetGPO/)=true OR match_regex(cmd_line, /(?i)Get-DomainGPOComputerLocalGroupMapping/)=true
+  OR match_regex(cmd_line, /(?i)Find-GPOComputerAdmin/)=true OR match_regex(cmd_line,
+  /(?i)Get-DomainGPOLocalGroup/)=true OR match_regex(cmd_line, /(?i)Get-NetGPOGroup/)=true
+  OR match_regex(cmd_line, /(?i)Get-DomainGPOUserLocalGroupMapping/)=true OR match_regex(cmd_line,
+  /(?i)Find-GPOLocation/)=true OR match_regex(cmd_line, /(?i)Get-DomainGroup/)=true
+  OR match_regex(cmd_line, /(?i)Get-NetGroup/)=true OR match_regex(cmd_line, /(?i)Get-DomainGroupMember/)=true
+  OR match_regex(cmd_line, /(?i)Get-NetGroupMember/)=true OR match_regex(cmd_line,
+  /(?i)Get-DomainManagedSecurityGroup/)=true OR match_regex(cmd_line, /(?i)Find-ManagedSecurityGroups/)=true
+  OR match_regex(cmd_line, /(?i)Get-DomainOU/)=true OR match_regex(cmd_line, /(?i)Get-NetOU/)=true
+  OR match_regex(cmd_line, /(?i)Get-DomainUser/)=true OR match_regex(cmd_line, /(?i)Get-NetUser/)=true
+  OR match_regex(cmd_line, /(?i)Get-DomainUserEvent/)=true OR match_regex(cmd_line,
+  /(?i)Get-UserEvent/)=true OR match_regex(cmd_line, /(?i)Get-NetLocalGroup/)=true
+  OR match_regex(cmd_line, /(?i)Get-NetLocalGroupMember/)=true OR match_regex(cmd_line,
+  /(?i)Get-NetLoggedon/)=true OR match_regex(cmd_line, /(?i)Get-RegLoggedOn/)=true
+  OR match_regex(cmd_line, /(?i)Get-WMIRegLastLoggedOn/)=true OR match_regex(cmd_line,
+  /(?i)Get-LastLoggedOn/)=true )
+
+  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line])
+  | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Windows Discovery Techniques
+  asset_type: Windows
+  cis20:
+  - CIS 16
+  - CIS 20
+  confidence: 100
+  context:
+  - Source:AD
+  - Source:Endpoint
+  - Stage:Recon
+  - Stage:Command And Control
+  - Consequence:Loss Of Control
+  impact: 80
+  kill_chain_phases:
+  - Actions on Objectives
+  message: PowerSploit malware is searching for and using specific accounts, groups
+    and policies, such as the last logged on account, a local Net group, etc. Operation
+    is performed at the device $dest_device_id$, by the account $dest_user_id$ via
+    command $cmd_line$
+  mitre_attack_id:
+  - T1078
+  - T1087
+  - T1484
+  nist:
+  - PR.AC
+  - PR.IP
+  observable:
+  - name: dest_user_id
+    role:
+    - Actor
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: cmd_line
+    role:
+    - Others
+    type: processname
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - process
+  - dest_device_id
+  - dest_user_id
+  risk_score: 80
+  risk_severity: high
+  security_domain: endpoint
+type: TTP
+version: 1
diff --git a/dist/ssa/detections/reconnaissance_and_access_to_active_directoty_infrastructure_via_powersploit_modules.yml b/dist/ssa/detections/reconnaissance_and_access_to_active_directoty_infrastructure_via_powersploit_modules.yml
new file mode 100644
index 0000000000..94b71630bf
--- /dev/null
+++ b/dist/ssa/detections/reconnaissance_and_access_to_active_directoty_infrastructure_via_powersploit_modules.yml
@@ -0,0 +1,93 @@
+author: Stanislav Miskovic, Splunk
+datamodel: []
+date: '2020-11-06'
+description: This detection identifies access to PowerSploit modules for reconnaissance
+  and access to elements of Active Directory infrastructure, such as domain identifiers,
+  AD sites and forests, and trust relations.
+how_to_implement: You must be ingesting Windows Security logs from devices of interest,
+  including the event ID 4688 with enabled command line logging.
+id: db08ac40-ee14-43e9-9a75-dddd059ef812
+known_false_positives: None identified.
+name: Reconnaissance and Access to Active Directoty Infrastructure via PowerSploit
+  modules
+product:
+- Splunk Behavioral Analytics
+references:
+- https://github.com/PowerShellMafia/PowerSploit
+risk_message: PowerSploit malware is seaching for or accessing Active Directory objects
+  such as domain sites, domain trusts, AD forests, etc. Operation is performed at
+  the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$
+search: '| from read_ssa_enriched_events()
+
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
+  "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
+  /(?i)Get-DomainSID/)=true OR match_regex(cmd_line, /(?i)Get-DomainSite/)=true OR
+  match_regex(cmd_line, /(?i)Get-NetSite/)=true OR match_regex(cmd_line, /(?i)Get-DomainSubnet/)=true
+  OR match_regex(cmd_line, /(?i)Get-NetSubnet/)=true OR match_regex(cmd_line, /(?i)Get-DomainTrust/)=true
+  OR match_regex(cmd_line, /(?i)Get-NetDomainTrust/)=true OR match_regex(cmd_line,
+  /(?i)Get-DomainTrustMapping/)=true OR match_regex(cmd_line, /(?i)Invoke-MapDomainTrust/)=true
+  OR match_regex(cmd_line, /(?i)Get-Forest/)=true OR match_regex(cmd_line, /(?i)Get-NetForest/)=true
+  OR match_regex(cmd_line, /(?i)Get-ForestDomain/)=true OR match_regex(cmd_line, /(?i)Get-NetForestDomain/)=true
+  OR match_regex(cmd_line, /(?i)Get-ForestGlobalCatalog/)=true OR match_regex(cmd_line,
+  /(?i)Get-NetForestCatalog/)=true OR match_regex(cmd_line, /(?i)Get-ForestTrust/)=true
+  OR match_regex(cmd_line, /(?i)Get-NetForestTrust/)=true )
+
+  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line])
+  | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Windows Discovery Techniques
+  asset_type: Windows
+  cis20:
+  - CIS 16
+  - CIS 20
+  confidence: 100
+  context:
+  - Source:AD
+  - Source:Endpoint
+  - Stage:Recon
+  - Stage:Command And Control
+  - Consequence:Loss Of Control
+  impact: 80
+  kill_chain_phases:
+  - Actions on Objectives
+  message: PowerSploit malware is seaching for or accessing Active Directory objects
+    such as domain sites, domain trusts, AD forests, etc. Operation is performed at
+    the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$
+  mitre_attack_id:
+  - T1199
+  - T1482
+  - T1590
+  - T1591
+  - T1595
+  nist:
+  - PR.AC
+  - PR.IP
+  observable:
+  - name: dest_user_id
+    role:
+    - Actor
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: cmd_line
+    role:
+    - Others
+    type: processname
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - process
+  - dest_device_id
+  - dest_user_id
+  risk_score: 80
+  risk_severity: high
+  security_domain: endpoint
+type: TTP
+version: 1
diff --git a/dist/ssa/detections/reconnaissance_and_access_to_computers_and_domains_via_powersploit_modules.yml b/dist/ssa/detections/reconnaissance_and_access_to_computers_and_domains_via_powersploit_modules.yml
new file mode 100644
index 0000000000..7d9bc758d1
--- /dev/null
+++ b/dist/ssa/detections/reconnaissance_and_access_to_computers_and_domains_via_powersploit_modules.yml
@@ -0,0 +1,85 @@
+author: Stanislav Miskovic, Splunk
+datamodel: []
+date: '2020-11-06'
+description: This detection identifies access to PowerSploit modules that discover
+  computers, servers and domains that can be accessed or taken over.
+how_to_implement: You must be ingesting Windows Security logs from devices of interest,
+  including the event ID 4688 with enabled command line logging.
+id: fe1c4c5a-09f3-4b43-8129-560a7f38a08b
+known_false_positives: None identified.
+name: Reconnaissance and Access to Computers and Domains via PowerSploit modules
+product:
+- Splunk Behavioral Analytics
+references:
+- https://github.com/PowerShellMafia/PowerSploit
+risk_message: PowerSploit malware is seaching for or accessing domain controllers,
+  computers, file servers, etc. Operation is performed at the device $dest_device_id$,
+  by the account $dest_user_id$ via command $cmd_line$
+search: '| from read_ssa_enriched_events()
+
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
+  "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
+  /(?i)Get-ComputerDetail/)=true OR match_regex(cmd_line, /(?i)Get-Domain/)=true OR
+  match_regex(cmd_line, /(?i)Get-NetDomain/)=true OR match_regex(cmd_line, /(?i)Get-DomainComputer/)=true
+  OR match_regex(cmd_line, /(?i)Get-NetComputer/)=true OR match_regex(cmd_line, /(?i)Get-DomainController/)=true
+  OR match_regex(cmd_line, /(?i)Get-NetDomainController/)=true OR match_regex(cmd_line,
+  /(?i)Get-DomainFileServer/)=true OR match_regex(cmd_line, /(?i)Get-NetFileServer/)=true
+  )
+
+  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line])
+  | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Windows Discovery Techniques
+  asset_type: Windows
+  cis20:
+  - CIS 16
+  - CIS 20
+  confidence: 100
+  context:
+  - Source:AD
+  - Source:Endpoint
+  - Stage:Recon
+  - Stage:Command And Control
+  - Consequence:Loss Of Control
+  impact: 80
+  kill_chain_phases:
+  - Actions on Objectives
+  message: PowerSploit malware is seaching for or accessing domain controllers, computers,
+    file servers, etc. Operation is performed at the device $dest_device_id$, by the
+    account $dest_user_id$ via command $cmd_line$
+  mitre_attack_id:
+  - T1592
+  - T1590
+  - T1087
+  nist:
+  - PR.AC
+  - PR.IP
+  observable:
+  - name: dest_user_id
+    role:
+    - Actor
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: cmd_line
+    role:
+    - Others
+    type: processname
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - process
+  - dest_device_id
+  - dest_user_id
+  risk_score: 80
+  risk_severity: high
+  security_domain: endpoint
+type: TTP
+version: 1
diff --git a/dist/ssa/detections/reconnaissance_and_access_to_computers_via_mimikatz_modules.yml b/dist/ssa/detections/reconnaissance_and_access_to_computers_via_mimikatz_modules.yml
new file mode 100644
index 0000000000..e535127dfe
--- /dev/null
+++ b/dist/ssa/detections/reconnaissance_and_access_to_computers_via_mimikatz_modules.yml
@@ -0,0 +1,76 @@
+author: Stanislav Miskovic, Splunk
+datamodel: []
+date: '2020-11-06'
+description: This detection identifies use of Mimikatz modules for discovery of computers
+  and servers and access to them.
+how_to_implement: You must be ingesting Windows Security logs from devices of interest,
+  including the event ID 4688 with enabled command line logging.
+id: 48664505-7d22-44ee-87d2-4c8a5bdc3d14
+known_false_positives: None identified.
+name: Reconnaissance and Access to Computers via Mimikatz modules
+product:
+- Splunk Behavioral Analytics
+references:
+- https://github.com/gentilkiwi/mimikatz
+risk_message: Mimikatz malware is collecting information about computers. Operation
+  is performed at the device $dest_device_id$, by the account $dest_user_id$ via command
+  $cmd_line$
+search: '| from read_ssa_enriched_events()
+
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
+  "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
+  /(?i)net::ServerInfo/)=true )
+
+  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line])
+  | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Windows Discovery Techniques
+  asset_type: Windows
+  cis20:
+  - CIS 16
+  - CIS 20
+  confidence: 100
+  context:
+  - Source:AD
+  - Source:Endpoint
+  - Stage:Recon
+  impact: 50
+  kill_chain_phases:
+  - Actions on Objectives
+  message: Mimikatz malware is collecting information about computers. Operation is
+    performed at the device $dest_device_id$, by the account $dest_user_id$ via command
+    $cmd_line$
+  mitre_attack_id:
+  - T1592
+  nist:
+  - PR.AC
+  - PR.IP
+  observable:
+  - name: dest_user_id
+    role:
+    - Actor
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: cmd_line
+    role:
+    - Others
+    type: processname
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - process
+  - dest_device_id
+  - dest_user_id
+  risk_score: 50
+  risk_severity: medium
+  security_domain: endpoint
+type: TTP
+version: 1
diff --git a/dist/ssa/detections/reconnaissance_and_access_to_operating_system_elements_via_powersploit_modules.yml b/dist/ssa/detections/reconnaissance_and_access_to_operating_system_elements_via_powersploit_modules.yml
new file mode 100644
index 0000000000..c6e15a4764
--- /dev/null
+++ b/dist/ssa/detections/reconnaissance_and_access_to_operating_system_elements_via_powersploit_modules.yml
@@ -0,0 +1,93 @@
+author: Stanislav Miskovic, Splunk
+datamodel: []
+date: '2020-11-06'
+description: This detection identifies access to PowerSploit modules that discover
+  and access operating system elements, such as processes, services, registry locations,
+  security packages and files.
+how_to_implement: You must be ingesting Windows Security logs from devices of interest,
+  including the event ID 4688 with enabled command line logging.
+id: c1d33ad9-1727-4f9f-a474-4adbe4fed68a
+known_false_positives: None identified.
+name: Reconnaissance and Access to Operating System Elements via PowerSploit modules
+product:
+- Splunk Behavioral Analytics
+references:
+- https://github.com/PowerShellMafia/PowerSploit
+risk_message: PowerSploit malware is searching for and tapping into ongoing processes,
+  mounted drives or other operating system elements. Operation is performed at the
+  device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$
+search: '| from read_ssa_enriched_events()
+
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
+  "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
+  /(?i)Find-DomainProcess/)=true OR match_regex(cmd_line, /(?i)Invoke-ProcessHunter/)=true
+  OR match_regex(cmd_line, /(?i)Get-ServiceDetail/)=true OR match_regex(cmd_line,
+  /(?i)Get-WMIProcess/)=true OR match_regex(cmd_line, /(?i)Get-NetProcess/)=true OR
+  match_regex(cmd_line, /(?i)Get-SecurityPackage/)=true OR match_regex(cmd_line, /(?i)Find-DomainObjectPropertyOutlier/)=true
+  OR match_regex(cmd_line, /(?i)Get-DomainObject/)=true OR match_regex(cmd_line, /(?i)Get-ADObject/)=true
+  OR match_regex(cmd_line, /(?i)Get-WMIRegMountedDrive/)=true OR match_regex(cmd_line,
+  /(?i)Get-RegistryMountedDrive/)=true )
+
+  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line])
+  | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Windows Discovery Techniques
+  asset_type: Windows
+  cis20:
+  - CIS 16
+  - CIS 20
+  confidence: 100
+  context:
+  - Source:AD
+  - Source:Endpoint
+  - Stage:Recon
+  - Stage:Command And Control
+  - Consequence:Loss Of Control
+  impact: 80
+  kill_chain_phases:
+  - Actions on Objectives
+  message: PowerSploit malware is searching for and tapping into ongoing processes,
+    mounted drives or other operating system elements. Operation is performed at the
+    device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$
+  mitre_attack_id:
+  - T1057
+  - T1083
+  - T1592.002
+  - T1046
+  - T1012
+  - T1007
+  - T1047
+  - T1592
+  - T1518
+  nist:
+  - PR.AC
+  - PR.IP
+  observable:
+  - name: dest_user_id
+    role:
+    - Actor
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: cmd_line
+    role:
+    - Others
+    type: processname
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - process
+  - dest_device_id
+  - dest_user_id
+  risk_score: 80
+  risk_severity: high
+  security_domain: endpoint
+type: TTP
+version: 1
diff --git a/dist/ssa/detections/reconnaissance_and_access_to_processes_and_services_via_mimikatz_modules.yml b/dist/ssa/detections/reconnaissance_and_access_to_processes_and_services_via_mimikatz_modules.yml
new file mode 100644
index 0000000000..1386b1bcd0
--- /dev/null
+++ b/dist/ssa/detections/reconnaissance_and_access_to_processes_and_services_via_mimikatz_modules.yml
@@ -0,0 +1,76 @@
+author: Stanislav Miskovic, Splunk
+datamodel: []
+date: '2020-11-06'
+description: This detection identifies use of Mimikatz modules for discovery and access
+  to services and processes.
+how_to_implement: You must be ingesting Windows Security logs from devices of interest,
+  including the event ID 4688 with enabled command line logging.
+id: 0243d37c-57c1-4182-bfd1-39b212255fc8
+known_false_positives: None identified.
+name: Reconnaissance and Access to Processes and Services via Mimikatz modules
+product:
+- Splunk Behavioral Analytics
+references:
+- https://github.com/gentilkiwi/mimikatz
+risk_message: Mimikatz malware is listing processes and services. Operation is performed
+  at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$
+search: '| from read_ssa_enriched_events()
+
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
+  "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
+  /(?i)process::list/)=true OR match_regex(cmd_line, /(?i)service::list/)=true )
+
+  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line])
+  | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Windows Discovery Techniques
+  asset_type: Windows
+  cis20:
+  - CIS 16
+  - CIS 20
+  confidence: 100
+  context:
+  - Source:AD
+  - Source:Endpoint
+  - Stage:Recon
+  impact: 50
+  kill_chain_phases:
+  - Actions on Objectives
+  message: Mimikatz malware is listing processes and services. Operation is performed
+    at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$
+  mitre_attack_id:
+  - T1007
+  - T1046
+  - T1057
+  nist:
+  - PR.AC
+  - PR.IP
+  observable:
+  - name: dest_user_id
+    role:
+    - Actor
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: cmd_line
+    role:
+    - Others
+    type: processname
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - process
+  - dest_device_id
+  - dest_user_id
+  risk_score: 50
+  risk_severity: medium
+  security_domain: endpoint
+type: TTP
+version: 1
diff --git a/dist/ssa/detections/reconnaissance_and_access_to_shared_resources_via_mimikatz_modules.yml b/dist/ssa/detections/reconnaissance_and_access_to_shared_resources_via_mimikatz_modules.yml
new file mode 100644
index 0000000000..b844115ffb
--- /dev/null
+++ b/dist/ssa/detections/reconnaissance_and_access_to_shared_resources_via_mimikatz_modules.yml
@@ -0,0 +1,81 @@
+author: Stanislav Miskovic, Splunk
+datamodel: []
+date: '2020-11-06'
+description: This detection identifies use of Mimikatz modules for discovery and access
+  to network shares.
+how_to_implement: You must be ingesting Windows Security logs from devices of interest,
+  including the event ID 4688 with enabled command line logging.
+id: c97b6eb9-1d8b-4017-bbbb-2af7fc17bc3f
+known_false_positives: None identified.
+name: Reconnaissance and Access to Shared Resources via Mimikatz modules
+product:
+- Splunk Behavioral Analytics
+references:
+- https://github.com/gentilkiwi/mimikatz
+risk_message: Mimikatz malware is searching for and accessing network shares. Operation
+  is performed at the device $dest_device_id$, by the account $dest_user_id$ via command
+  $cmd_line$
+search: '| from read_ssa_enriched_events()
+
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
+  "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
+  /(?i)net::share/)=true )
+
+  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line])
+  | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Windows Discovery Techniques
+  asset_type: Windows
+  cis20:
+  - CIS 16
+  - CIS 20
+  confidence: 100
+  context:
+  - Source:AD
+  - Source:Endpoint
+  - Stage:Recon
+  - Stage:Lateral Movement
+  - Stage:Collection
+  impact: 70
+  kill_chain_phases:
+  - Actions on Objectives
+  message: Mimikatz malware is searching for and accessing network shares. Operation
+    is performed at the device $dest_device_id$, by the account $dest_user_id$ via
+    command $cmd_line$
+  mitre_attack_id:
+  - T1021
+  - T1039
+  - T1135
+  - T1021.002
+  nist:
+  - PR.AC
+  - PR.IP
+  observable:
+  - name: dest_user_id
+    role:
+    - Actor
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: cmd_line
+    role:
+    - Others
+    type: processname
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - process
+  - dest_device_id
+  - dest_user_id
+  risk_score: 70
+  risk_severity: low
+  security_domain: endpoint
+type: TTP
+version: 1
diff --git a/dist/ssa/detections/reconnaissance_and_access_to_shared_resources_via_powersploit_modules.yml b/dist/ssa/detections/reconnaissance_and_access_to_shared_resources_via_powersploit_modules.yml
new file mode 100644
index 0000000000..a5717e2d6b
--- /dev/null
+++ b/dist/ssa/detections/reconnaissance_and_access_to_shared_resources_via_powersploit_modules.yml
@@ -0,0 +1,85 @@
+author: Stanislav Miskovic, Splunk
+datamodel: []
+date: '2020-11-06'
+description: This detection identifies access to PowerSploit modules that discover
+  and access network and distributed file system shares.
+how_to_implement: You must be ingesting Windows Security logs from devices of interest,
+  including the event ID 4688 with enabled command line logging.
+id: 6b7ca431-6b1e-4b40-9589-21cb368e369e
+known_false_positives: None identified.
+name: Reconnaissance and Access to Shared Resources via PowerSploit modules
+product:
+- Splunk Behavioral Analytics
+references:
+- https://github.com/PowerShellMafia/PowerSploit
+risk_message: PowerSploit malware is searching for and accessing network shares. Operation
+  is performed at the device $dest_device_id$, by the account $dest_user_id$ via command
+  $cmd_line$
+search: '| from read_ssa_enriched_events()
+
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
+  "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
+  /(?i)Find-DomainShare/)=true OR match_regex(cmd_line, /(?i)Invoke-ShareFinder/)=true
+  OR match_regex(cmd_line, /(?i)Find-InterestingDomainShareFile/)=true OR match_regex(cmd_line,
+  /(?i)Invoke-FileFinder/)=true OR match_regex(cmd_line, /(?i)Find-InterestingFile/)=true
+  OR match_regex(cmd_line, /(?i)Get-DomainDFSShare/)=true OR match_regex(cmd_line,
+  /(?i)Get-DFSshare/)=true OR match_regex(cmd_line, /(?i)Get-NetShare/)=true )
+
+  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line])
+  | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Windows Discovery Techniques
+  asset_type: Windows
+  cis20:
+  - CIS 16
+  - CIS 20
+  confidence: 100
+  context:
+  - Source:AD
+  - Source:Endpoint
+  - Stage:Recon
+  - Stage:Lateral Movement
+  - Stage:Collection
+  impact: 70
+  kill_chain_phases:
+  - Actions on Objectives
+  message: PowerSploit malware is searching for and accessing network shares. Operation
+    is performed at the device $dest_device_id$, by the account $dest_user_id$ via
+    command $cmd_line$
+  mitre_attack_id:
+  - T1021
+  - T1039
+  - T1135
+  - T1021.002
+  nist:
+  - PR.AC
+  - PR.IP
+  observable:
+  - name: dest_user_id
+    role:
+    - Actor
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: cmd_line
+    role:
+    - Others
+    type: processname
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - process
+  - dest_device_id
+  - dest_user_id
+  risk_score: 70
+  risk_severity: low
+  security_domain: endpoint
+type: TTP
+version: 1
diff --git a/dist/ssa/detections/reconnaissance_of_access_and_persistence_opportunities_via_powersploit_modules.yml b/dist/ssa/detections/reconnaissance_of_access_and_persistence_opportunities_via_powersploit_modules.yml
new file mode 100644
index 0000000000..180502299c
--- /dev/null
+++ b/dist/ssa/detections/reconnaissance_of_access_and_persistence_opportunities_via_powersploit_modules.yml
@@ -0,0 +1,96 @@
+author: Stanislav Miskovic, Splunk
+datamodel: []
+date: '2020-11-05'
+description: This detection identifies use of PowerSploit modules that discover opportunities
+  for malicious access and persistence. Some examples include access to admin accounts,
+  weak access control policies, landing paths for dropping malicious software or data
+  to exfiltrate, registry locations to land autorun parameters, task scheduling opportunities,
+  as well as services and system files that can be compromised.
+how_to_implement: You must be ingesting Windows Security logs from devices of interest,
+  including the event ID 4688 with enabled command line logging.
+id: 3d8bd7f3-1061-4ac7-9225-6764cc0684d7
+known_false_positives: None identified.
+name: Reconnaissance of Access and Persistence Opportunities via PowerSploit modules
+product:
+- Splunk Behavioral Analytics
+references:
+- https://github.com/PowerShellMafia/PowerSploit
+risk_message: PowerSploit malware is searching for an entry point into the infrastructure,
+  such as local admin accounts, opportunities to hijack processes, unattended install
+  files, or modifiable access objects. Operation is performed at the device $dest_device_id$,
+  by the account $dest_user_id$ via command $cmd_line$
+search: '| from read_ssa_enriched_events()
+
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
+  "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
+  /(?i)Find-LocalAdminAccess/)=true OR match_regex(cmd_line, /(?i)Find-InterestingDomainAcl/)=true
+  OR match_regex(cmd_line, /(?i)Invoke-ACLScanner/)=true OR match_regex(cmd_line,
+  /(?i)Find-PathDLLHijack/)=true OR match_regex(cmd_line, /(?i)Find-ProcessDLLHijack/)=true
+  OR match_regex(cmd_line, /(?i)Get-DomainObjectAcl/)=true OR match_regex(cmd_line,
+  /(?i)Get-ObjectAcl/)=true OR match_regex(cmd_line, /(?i)Get-DomainPolicy/)=true
+  OR match_regex(cmd_line, /(?i)Get-ModifiablePath/)=true OR match_regex(cmd_line,
+  /(?i)Get-ModifiableRegistryAutoRun/)=true OR match_regex(cmd_line, /(?i)Get-ModifiableScheduledTaskFile/)=true
+  OR match_regex(cmd_line, /(?i)Get-ModifiableService/)=true OR match_regex(cmd_line,
+  /(?i)Get-ModifiableServiceFile/)=true OR match_regex(cmd_line, /(?i)Get-PathAcl/)=true
+  OR match_regex(cmd_line, /(?i)Get-UnattendedInstallFile/)=true OR match_regex(cmd_line,
+  /(?i)Get-UnquotedService/)=true )
+
+  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line])
+  | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Windows Discovery Techniques
+  asset_type: Windows
+  cis20:
+  - CIS 16
+  - CIS 20
+  confidence: 100
+  context:
+  - Source:AD
+  - Source:Endpoint
+  - Stage:Recon
+  impact: 60
+  kill_chain_phases:
+  - Actions on Objectives
+  message: PowerSploit malware is searching for an entry point into the infrastructure,
+    such as local admin accounts, opportunities to hijack processes, unattended install
+    files, or modifiable access objects. Operation is performed at the device $dest_device_id$,
+    by the account $dest_user_id$ via command $cmd_line$
+  mitre_attack_id:
+  - T1053
+  - T1068
+  - T1078
+  - T1543
+  - T1547
+  - T1574
+  nist:
+  - PR.AC
+  - PR.IP
+  observable:
+  - name: dest_user_id
+    role:
+    - Actor
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: cmd_line
+    role:
+    - Others
+    type: processname
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - process
+  - dest_device_id
+  - dest_user_id
+  risk_score: 60
+  risk_severity: low
+  security_domain: endpoint
+type: TTP
+version: 1
diff --git a/dist/ssa/detections/reconnaissance_of_connectivity_via_powersploit_modules.yml b/dist/ssa/detections/reconnaissance_of_connectivity_via_powersploit_modules.yml
new file mode 100644
index 0000000000..17fa0d433f
--- /dev/null
+++ b/dist/ssa/detections/reconnaissance_of_connectivity_via_powersploit_modules.yml
@@ -0,0 +1,86 @@
+author: Stanislav Miskovic, Splunk
+datamodel: []
+date: '2020-11-06'
+description: This detection identifies access to PowerSploit modules for reconnaissance
+  of connectivity.
+how_to_implement: You must be ingesting Windows Security logs from devices of interest,
+  including the event ID 4688 with enabled command line logging.
+id: 525d32fd-65dd-4732-9b72-3cfc7ddddbd2
+known_false_positives: None identified.
+name: Reconnaissance of Connectivity via PowerSploit modules
+product:
+- Splunk Behavioral Analytics
+references:
+- https://github.com/PowerShellMafia/PowerSploit
+risk_message: PowerSploit malware is performing port scans or searching for various
+  connectivity details such as DNS data, proxies, or ongoing RDP connections. Operation
+  is performed at the device $dest_device_id$, by the account $dest_user_id$ via command
+  $cmd_line$
+search: '| from read_ssa_enriched_events()
+
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
+  "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
+  /(?i)Get-DomainDNSRecord/)=true OR match_regex(cmd_line, /(?i)Get-DNSRecord/)=true
+  OR match_regex(cmd_line, /(?i)Get-DomainDNSZone/)=true OR match_regex(cmd_line,
+  /(?i)Get-DNSZone/)=true OR match_regex(cmd_line, /(?i)Invoke-ReverseDnsLookup/)=true
+  OR match_regex(cmd_line, /(?i)Get-WMIRegCachedRDPConnection/)=true OR match_regex(cmd_line,
+  /(?i)Get-CachedRDPConnection/)=true OR match_regex(cmd_line, /(?i)Get-WMIRegProxy/)=true
+  OR match_regex(cmd_line, /(?i)Get-Proxy/)=true OR match_regex(cmd_line, /(?i)Invoke-Portscan/)=true
+  )
+
+  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line])
+  | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Windows Discovery Techniques
+  asset_type: Windows
+  cis20:
+  - CIS 16
+  - CIS 20
+  confidence: 100
+  context:
+  - Source:AD
+  - Source:Endpoint
+  - Stage:Recon
+  impact: 70
+  kill_chain_phases:
+  - Actions on Objectives
+  message: PowerSploit malware is performing port scans or searching for various connectivity
+    details such as DNS data, proxies, or ongoing RDP connections. Operation is performed
+    at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$
+  mitre_attack_id:
+  - T1021
+  - T1039
+  - T1135
+  - T1021.002
+  nist:
+  - PR.AC
+  - PR.IP
+  observable:
+  - name: dest_user_id
+    role:
+    - Actor
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: cmd_line
+    role:
+    - Others
+    type: processname
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - process
+  - dest_device_id
+  - dest_user_id
+  risk_score: 70
+  risk_severity: low
+  security_domain: endpoint
+type: TTP
+version: 1
diff --git a/dist/ssa/detections/reconnaissance_of_credential_stores_and_services_via_mimikatz_modules.yml b/dist/ssa/detections/reconnaissance_of_credential_stores_and_services_via_mimikatz_modules.yml
new file mode 100644
index 0000000000..917c3e96a1
--- /dev/null
+++ b/dist/ssa/detections/reconnaissance_of_credential_stores_and_services_via_mimikatz_modules.yml
@@ -0,0 +1,86 @@
+author: Stanislav Miskovic, Splunk
+datamodel: []
+date: '2020-11-03'
+description: This detection identifies reconnaissance of credential stores and use
+  of CryptoAPI services by Mimikatz modules.
+how_to_implement: You must be ingesting Windows Security logs from devices of interest,
+  including the event ID 4688 with enabled command line logging.
+id: 5facee5b-79e4-47ab-b0e6-c625acc0554f
+known_false_positives: None identified.
+name: Reconnaissance of Credential Stores and Services via Mimikatz modules
+product:
+- Splunk Behavioral Analytics
+references:
+- https://github.com/gentilkiwi/mimikatz
+risk_message: Mimikatz malware is searching for and accessing credential stores. Operation
+  is performed at the device $dest_device_id$, by the account $dest_user_id$ via command
+  $cmd_line$
+search: '| from read_ssa_enriched_events()
+
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
+  "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
+  /(?i)crypto::capi/)=true OR match_regex(cmd_line, /(?i)crypto::cng/)=true OR match_regex(cmd_line,
+  /(?i)crypto::providers/)=true OR match_regex(cmd_line, /(?i)crypto::stores/)=true
+  OR match_regex(cmd_line, /(?i)crypto::sc/)=true )
+
+  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line])
+  | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Windows Discovery Techniques
+  asset_type: Windows
+  cis20:
+  - CIS 16
+  - CIS 20
+  confidence: 100
+  context:
+  - Source:AD
+  - Source:Endpoint
+  - Stage:Recon
+  - Stage:Credential Access
+  impact: 80
+  kill_chain_phases:
+  - Actions on Objectives
+  message: Mimikatz malware is searching for and accessing credential stores. Operation
+    is performed at the device $dest_device_id$, by the account $dest_user_id$ via
+    command $cmd_line$
+  mitre_attack_id:
+  - T1098
+  - T1590.001
+  - T1078
+  - T1589.001
+  - T1590
+  - T1068
+  - T1589
+  - T1590.003
+  nist:
+  - PR.AC
+  - PR.IP
+  observable:
+  - name: dest_user_id
+    role:
+    - Actor
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: cmd_line
+    role:
+    - Others
+    type: processname
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - process
+  - dest_device_id
+  - dest_user_id
+  risk_score: 80
+  risk_severity: high
+  security_domain: endpoint
+type: TTP
+version: 1
diff --git a/dist/ssa/detections/reconnaissance_of_defensive_tools_via_powersploit_modules.yml b/dist/ssa/detections/reconnaissance_of_defensive_tools_via_powersploit_modules.yml
new file mode 100644
index 0000000000..003200c4f9
--- /dev/null
+++ b/dist/ssa/detections/reconnaissance_of_defensive_tools_via_powersploit_modules.yml
@@ -0,0 +1,79 @@
+author: Stanislav Miskovic, Splunk
+datamodel: []
+date: '2020-11-05'
+description: This detection identifies use of PowerSploit modules for assessment of
+  presence of defensive tools.
+how_to_implement: You must be ingesting Windows Security logs from devices of interest,
+  including the event ID 4688 with enabled command line logging.
+id: 24b4e659-63a2-4e7b-89ac-87dd659c7110
+known_false_positives: None identified.
+name: Reconnaissance of Defensive Tools via PowerSploit modules
+product:
+- Splunk Behavioral Analytics
+references:
+- https://github.com/PowerShellMafia/PowerSploit
+risk_message: PowerSploit malware is looking for presence of anti virus software.
+  Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
+  via command $cmd_line$
+search: '| from read_ssa_enriched_events()
+
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
+  "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
+  /(?i)Find-AVSignature/)=true )
+
+  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line])
+  | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Windows Discovery Techniques
+  asset_type: Windows
+  cis20:
+  - CIS 16
+  - CIS 20
+  confidence: 100
+  context:
+  - Source:AD
+  - Source:Endpoint
+  - Stage:Recon
+  impact: 40
+  kill_chain_phases:
+  - Actions on Objectives
+  message: PowerSploit malware is looking for presence of anti virus software. Operation
+    is performed at the device $dest_device_id$, by the account $dest_user_id$ via
+    command $cmd_line$
+  mitre_attack_id:
+  - T1592.002
+  - T1595.002
+  - T1592
+  - T1595
+  nist:
+  - PR.AC
+  - PR.IP
+  observable:
+  - name: dest_user_id
+    role:
+    - Actor
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: cmd_line
+    role:
+    - Others
+    type: processname
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - process
+  - dest_device_id
+  - dest_user_id
+  risk_score: 40
+  risk_severity: medium
+  security_domain: endpoint
+type: TTP
+version: 1
diff --git a/dist/ssa/detections/reconnaissance_of_privilege_escalation_opportunities_via_powersploit_modules.yml b/dist/ssa/detections/reconnaissance_of_privilege_escalation_opportunities_via_powersploit_modules.yml
new file mode 100644
index 0000000000..b18fdedae6
--- /dev/null
+++ b/dist/ssa/detections/reconnaissance_of_privilege_escalation_opportunities_via_powersploit_modules.yml
@@ -0,0 +1,78 @@
+author: Stanislav Miskovic, Splunk
+datamodel: []
+date: '2020-11-05'
+description: This detection identifies use of PowerSploit modules for assessment of
+  privilege escalation opportunities.
+how_to_implement: You must be ingesting Windows Security logs from devices of interest,
+  including the event ID 4688 with enabled command line logging.
+id: b9b4492c-2af8-449b-beb4-b1b78d963321
+known_false_positives: None identified.
+name: Reconnaissance of Privilege Escalation Opportunities via PowerSploit modules
+product:
+- Splunk Behavioral Analytics
+references:
+- https://github.com/PowerShellMafia/PowerSploit
+risk_message: PowerSploit malware is engaging its privilege escalation module. Operation
+  is performed at the device $dest_device_id$, by the account $dest_user_id$ via command
+  $cmd_line$
+search: '| from read_ssa_enriched_events()
+
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
+  "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
+  /(?i)Invoke-PrivescAudit/)=true )
+
+  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line])
+  | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Windows Discovery Techniques
+  asset_type: Windows
+  cis20:
+  - CIS 16
+  - CIS 20
+  confidence: 100
+  context:
+  - Source:AD
+  - Source:Endpoint
+  - Stage:Recon
+  impact: 60
+  kill_chain_phases:
+  - Actions on Objectives
+  message: PowerSploit malware is engaging its privilege escalation module. Operation
+    is performed at the device $dest_device_id$, by the account $dest_user_id$ via
+    command $cmd_line$
+  mitre_attack_id:
+  - T1068
+  - T1078
+  - T1098
+  nist:
+  - PR.AC
+  - PR.IP
+  observable:
+  - name: dest_user_id
+    role:
+    - Actor
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: cmd_line
+    role:
+    - Others
+    type: processname
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - process
+  - dest_device_id
+  - dest_user_id
+  risk_score: 60
+  risk_severity: low
+  security_domain: endpoint
+type: TTP
+version: 1
diff --git a/dist/ssa/detections/reconnaissance_of_process_or_service_hijacking_opportunities_via_mimikatz_modules.yml b/dist/ssa/detections/reconnaissance_of_process_or_service_hijacking_opportunities_via_mimikatz_modules.yml
new file mode 100644
index 0000000000..01f877fb49
--- /dev/null
+++ b/dist/ssa/detections/reconnaissance_of_process_or_service_hijacking_opportunities_via_mimikatz_modules.yml
@@ -0,0 +1,85 @@
+author: Stanislav Miskovic, Splunk
+datamodel: []
+date: '2020-11-05'
+description: This detection identifies use of Mimikatz modules for discovery of process
+  or service hijacking opportunities via Microsoft Detours compatibility. Microsoft
+  Detours is an open source library for intercepting, monitoring and instrumenting
+  binary functions on Microsoft Windows. Detours intercepts Win32 functions by re-writing
+  the in-memory code for target functions. The Detours package also contains utilities
+  to attach arbitrary DLLs and data segments called payloads to any Win32 binary.
+how_to_implement: You must be ingesting Windows Security logs from devices of interest,
+  including the event ID 4688 with enabled command line logging.
+id: fc5c1cbd-7494-4314-aad2-458d6fd4fada
+known_false_positives: None identified.
+name: Reconnaissance of Process or Service Hijacking Opportunities via Mimikatz modules
+product:
+- Splunk Behavioral Analytics
+references:
+- https://github.com/gentilkiwi/mimikatz
+- https://en.wikipedia.org/wiki/Microsoft_Detours
+risk_message: Mimikatz malware is looking for and invoking Microsoft Detours package
+  that enables spoofing of in-memory code. Operation is performed at the device $dest_device_id$,
+  by the account $dest_user_id$ via command $cmd_line$
+search: '| from read_ssa_enriched_events()
+
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
+  "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
+  /(?i)misc::detours/)=true )
+
+  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line])
+  | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Windows Discovery Techniques
+  asset_type: Windows
+  cis20:
+  - CIS 16
+  - CIS 20
+  confidence: 100
+  context:
+  - Source:AD
+  - Source:Endpoint
+  - Stage:Recon
+  - Stage:Command And Control
+  - Consequence:Loss Of Control
+  impact: 70
+  kill_chain_phases:
+  - Actions on Objectives
+  message: Mimikatz malware is looking for and invoking Microsoft Detours package
+    that enables spoofing of in-memory code. Operation is performed at the device
+    $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$
+  mitre_attack_id:
+  - T1543
+  - T1055
+  - T1574
+  nist:
+  - PR.AC
+  - PR.IP
+  observable:
+  - name: dest_user_id
+    role:
+    - Actor
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: cmd_line
+    role:
+    - Others
+    type: processname
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - process
+  - dest_device_id
+  - dest_user_id
+  risk_score: 70
+  risk_severity: low
+  security_domain: endpoint
+type: TTP
+version: 1
diff --git a/dist/ssa/detections/resize_shadowstorage_volume.yml b/dist/ssa/detections/resize_shadowstorage_volume.yml
new file mode 100644
index 0000000000..b173fa9bd4
--- /dev/null
+++ b/dist/ssa/detections/resize_shadowstorage_volume.yml
@@ -0,0 +1,65 @@
+author: Teoderick Contreras, Splunk
+datamodel:
+- Endpoint
+date: '2021-06-21'
+description: The following analytics identifies the resizing of shadowstorage by ransomware
+  malware to avoid the shadow volumes being made again. this technique is an alternative
+  by ransomware attacker than deleting the shadowstorage which is known alert in defensive
+  team. one example of ransomware that use this technique is CLOP ransomware where
+  it drops a .bat file that will resize the shadowstorage to minimum size as much
+  as possible
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+id: dbc30554-d27e-11eb-9e5e-acde48001122
+known_false_positives: network admin can resize the shadowstorage for valid purposes.
+name: Resize Shadowstorage Volume
+product:
+- Splunk Behavioral Analytics
+references:
+- https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html
+- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND like(cmd_line, "%resize%") AND like(cmd_line, "%shadowstorage%")
+  AND like(cmd_line, "%maxsize%") AND process_name="vssadmin.exe" | eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
+  body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
+  "parent_process_name", parent_process_name, "process_path", process_path]) | into
+  write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Clop Ransomware
+  - Ransomware
+  cis20:
+  - CIS 10
+  - CIS 13
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/windows-security.log
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1489
+  nist:
+  - PR.DS
+  - PR.IP
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  risk_severity: high
+  security_domain: endpoint
+type: TTP
+version: 2
diff --git a/dist/ssa/detections/setting_credentials_via_dsinternals_modules.yml b/dist/ssa/detections/setting_credentials_via_dsinternals_modules.yml
new file mode 100644
index 0000000000..6f6a99b98e
--- /dev/null
+++ b/dist/ssa/detections/setting_credentials_via_dsinternals_modules.yml
@@ -0,0 +1,91 @@
+author: Stanislav Miskovic, Splunk
+datamodel: []
+date: '2020-11-03'
+description: This detection identifies illegal setting of credentials via DSInternals
+  modules.
+how_to_implement: You must be ingesting Windows Security logs from devices of interest,
+  including the event ID 4688 with enabled command line logging.
+id: d5ef590f-9bde-49eb-9c63-2f5b62a65b9c
+known_false_positives: None identified.
+name: Setting Credentials via DSInternals modules
+product:
+- Splunk Behavioral Analytics
+references:
+- https://github.com/MichaelGrafnetter/DSInternals
+risk_message: DSInternals malware is accessing, using or setting Active Directory
+  or Azure credentials and accounts. Operation is performed at the device $dest_device_id$,
+  by the account $dest_user_id$ via command $cmd_line$
+search: '| from read_ssa_enriched_events()
+
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event,
+  "process_path"), "string", null), cmd_line=ucast(map_get(input_event, "process"),
+  "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Add-ADDBSidHistory/)=true
+  OR match_regex(cmd_line, /(?i)Add-ADReplNgcKey/)=true OR match_regex(cmd_line, /(?i)Set-ADDBAccountPassword/)=true
+  OR match_regex(cmd_line, /(?i)Set-ADDBAccountPasswordHash/)=true OR match_regex(cmd_line,
+  /(?i)Set-ADDBBootKey/)=true OR match_regex(cmd_line, /(?i)Set-SamAccountPasswordHash/)=true
+  OR match_regex(cmd_line, /(?i)Set-AzureADUserEx/)=true )
+
+  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line])
+  | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Windows Persistence Techniques
+  asset_type: Windows
+  cis20:
+  - CIS 16
+  - CIS 20
+  confidence: 100
+  context:
+  - Source:AD
+  - Source:Endpoint
+  - Source:Cloud Data
+  - Stage:Credential Access
+  - Consequence:Loss Of Control
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllDSInternalsModules.log
+  impact: 80
+  kill_chain_phases:
+  - Actions on Objectives
+  message: DSInternals malware is accessing, using or setting Active Directory or
+    Azure credentials and accounts. Operation is performed at the device $dest_device_id$,
+    by the account $dest_user_id$ via command $cmd_line$
+  mitre_attack_id:
+  - T1068
+  - T1078
+  - T1098
+  nist:
+  - PR.AC
+  - PR.IP
+  observable:
+  - name: dest_user_id
+    role:
+    - Actor
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: cmd_line
+    role:
+    - Others
+    type: processname
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - _time
+  - process_path
+  - dest_user_id
+  - process
+  risk_score: 80
+  risk_severity: high
+  security_domain: endpoint
+type: TTP
+version: 1
diff --git a/dist/ssa/detections/setting_credentials_via_mimikatz_modules.yml b/dist/ssa/detections/setting_credentials_via_mimikatz_modules.yml
new file mode 100644
index 0000000000..69e8975d54
--- /dev/null
+++ b/dist/ssa/detections/setting_credentials_via_mimikatz_modules.yml
@@ -0,0 +1,81 @@
+author: Stanislav Miskovic, Splunk
+datamodel: []
+date: '2020-11-03'
+description: This detection identifies illegal setting of credentials via Mimikatz
+  modules.
+how_to_implement: You must be ingesting Windows Security logs from devices of interest,
+  including the event ID 4688 with enabled command line logging.
+id: c8b84699-7652-4363-910f-efd1ca82f780
+known_false_positives: None identified.
+name: Setting Credentials via Mimikatz modules
+product:
+- Splunk Behavioral Analytics
+references:
+- https://github.com/gentilkiwi/mimikatz
+risk_message: Mimikatz malware is accessing, using or setting account credentials.
+  Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
+  via command $cmd_line$
+search: '| from read_ssa_enriched_events()
+
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
+  "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
+  /(?i)misc::addsid/)=true OR match_regex(cmd_line, /(?i)CRYPTO::scauth/)=true )
+
+  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line])
+  | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Windows Persistence Techniques
+  asset_type: Windows
+  cis20:
+  - CIS 16
+  - CIS 20
+  confidence: 100
+  context:
+  - Source:AD
+  - Source:Endpoint
+  - Stage:Credential Access
+  - Consequence:Loss Of Control
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllMimikatzModules.log
+  impact: 80
+  kill_chain_phases:
+  - Actions on Objectives
+  message: Mimikatz malware is accessing, using or setting account credentials. Operation
+    is performed at the device $dest_device_id$, by the account $dest_user_id$ via
+    command $cmd_line$
+  mitre_attack_id:
+  - T1068
+  - T1078
+  - T1098
+  nist:
+  - PR.AC
+  - PR.IP
+  observable:
+  - name: dest_user_id
+    role:
+    - Actor
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: cmd_line
+    role:
+    - Others
+    type: processname
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - dest_device_id
+  - dest_user_id
+  - process
+  - _time
+  risk_score: 80
+  risk_severity: high
+  security_domain: endpoint
+type: TTP
+version: 1
diff --git a/dist/ssa/detections/setting_credentials_via_powersploit_modules.yml b/dist/ssa/detections/setting_credentials_via_powersploit_modules.yml
new file mode 100644
index 0000000000..b7be76f7d7
--- /dev/null
+++ b/dist/ssa/detections/setting_credentials_via_powersploit_modules.yml
@@ -0,0 +1,81 @@
+author: Stanislav Miskovic, Splunk
+datamodel: []
+date: '2020-11-03'
+description: This detection identifies illegal setting of credentials via PowerSploit
+  modules.
+how_to_implement: You must be ingesting Windows Security logs from devices of interest,
+  including the event ID 4688 with enabled command line logging.
+id: 07b2a501-f967-4ddc-9f56-2dce46dfce44
+known_false_positives: None identified.
+name: Setting Credentials via PowerSploit modules
+product:
+- Splunk Behavioral Analytics
+references:
+- https://github.com/PowerShellMafia/PowerSploit
+risk_message: PowerSploit malware is setting passwords on Active Directory accounts.
+  Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
+  via command $cmd_line$
+search: '| from read_ssa_enriched_events()
+
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
+  "event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
+  /(?i)Set-DomainUserPassword/)=true )
+
+  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line])
+  | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Windows Persistence Techniques
+  asset_type: Windows
+  cis20:
+  - CIS 16
+  - CIS 20
+  confidence: 100
+  context:
+  - Source:AD
+  - Source:Endpoint
+  - Stage:Credential Access
+  - Consequence:Loss Of Control
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllPowerSploitModulesWithOldNames.log
+  impact: 90
+  kill_chain_phases:
+  - Actions on Objectives
+  message: PowerSploit malware is setting passwords on Active Directory accounts.
+    Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
+    via command $cmd_line$
+  mitre_attack_id:
+  - T1068
+  - T1078
+  - T1098
+  nist:
+  - PR.AC
+  - PR.IP
+  observable:
+  - name: dest_user_id
+    role:
+    - Actor
+    type: User
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: cmd_line
+    role:
+    - Others
+    type: processname
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - dest_device_id
+  - dest_user_id
+  - process
+  - _time
+  risk_score: 90
+  risk_severity: high
+  security_domain: endpoint
+type: TTP
+version: 1
diff --git a/dist/ssa/detections/system_process_running_from_unexpected_location.yml b/dist/ssa/detections/system_process_running_from_unexpected_location.yml
new file mode 100644
index 0000000000..e2f559c1c3
--- /dev/null
+++ b/dist/ssa/detections/system_process_running_from_unexpected_location.yml
@@ -0,0 +1,279 @@
+author: Ignacio Bermudez Corrales, Splunk
+datamodel: []
+date: '2020-08-25'
+description: An attacker tries might try to use different version of a system command
+  without overriding original, or they might try to avoid some detection running the
+  process from a different folder. This detection checks that a list of system processes
+  run inside C:\\Windows\System32 or C:\\Windows\SysWOW64 The list of system processes
+  has been extracted from https://github.com/splunk/security_content/blob/develop/lookups/is_windows_system_file.csv
+  and the original detection https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml
+how_to_implement: Collect endpoint data such as sysmon or 4688 events.
+id: 28179107-099a-464a-94d3-08301e6c055f
+known_false_positives: None
+name: System Process Running from Unexpected Location
+product:
+- Splunk Behavioral Analytics
+references: []
+risk_message: A system process $process_name$ with commandline $cmd_line$ spawn in
+  non-default folder path in host $dest_device_id$
+search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
+  "dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
+  "string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
+  null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
+  null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
+  null)), event_id=ucast(map_get(input_event, "event_id"), "string", null);
+
+  $cond_1 = | from $ssa_input | where process_name="arp.exe" OR process_name="adaptertroubleshooter.exe"
+  OR process_name="applicationframehost.exe" OR process_name="atbroker.exe" OR process_name="authhost.exe"
+  OR process_name="autoworkplace.exe" OR process_name="axinstui.exe" OR process_name="backgroundtransferhost.exe"
+  OR process_name="bdehdcfg.exe" OR process_name="bdeuisrv.exe" OR process_name="bdeunlockwizard.exe"
+  OR process_name="bitlockerdeviceencryption.exe" OR process_name="bitlockerwizard.exe"
+  OR process_name="bitlockerwizardelev.exe" OR process_name="bytecodegenerator.exe"
+  OR process_name="camerasettingsuihost.exe" OR process_name="castsrv.exe" OR process_name="certenrollctrl.exe"
+  OR process_name="checknetisolation.exe" OR process_name="clipup.exe" OR process_name="cloudexperiencehostbroker.exe"
+  OR process_name="cloudnotifications.exe" OR process_name="cloudstoragewizard.exe"
+  OR process_name="compmgmtlauncher.exe" OR process_name="compattelrunner.exe" OR
+  process_name="computerdefaults.exe" OR process_name="credentialuibroker.exe" OR
+  process_name="dfdwiz.exe" OR process_name="dwwin.exe" OR process_name="dataexchangehost.exe"
+  OR process_name="defrag.exe" OR process_name="devicedisplayobjectprovider.exe" OR
+  process_name="deviceeject.exe" OR process_name="deviceenroller.exe" OR process_name="devicepairingwizard.exe"
+  OR process_name="deviceproperties.exe" OR process_name="disksnapshot.exe" OR process_name="dism.exe"
+  OR process_name="displayswitch.exe" OR process_name="dmnotificationbroker.exe" OR
+  process_name="dmomacpmo.exe" OR process_name="dpiscaling.exe" OR process_name="dsmusertask.exe"
+  OR process_name="dxpserver.exe" OR process_name="edpcleanup.exe" OR process_name="eosnotify.exe"
+  OR process_name="eap3host.exe" OR process_name="easpoliciesbrokerhost.exe" OR process_name="easeofaccessdialog.exe"
+  OR process_name="ehstorauthn.exe" OR process_name="fxscover.exe" OR process_name="fxssvc.exe"
+  OR process_name="fxsunatd.exe" OR process_name="filehistory.exe" OR process_name="fondue.exe"
+  OR process_name="gamepanel.exe" OR process_name="genvalobj.exe" OR process_name="gettingstarted.exe"
+  OR process_name="hostname.exe" OR process_name="icsentitlementhost.exe" OR process_name="infdefaultinstall.exe"
+  OR process_name="installagent.exe" OR process_name="languagecomponentsinstallercomhandler.exe"
+  OR process_name="launchtm.exe" OR process_name="launchwinapp.exe" OR process_name="legacynetuxhost.exe"
+  OR process_name="licensemanagershellext.exe" OR process_name="licensingui.exe" OR
+  process_name="locationnotificationwindows.exe" OR process_name="locationnotifications.exe"
+  OR process_name="locator.exe" OR process_name="lockapphost.exe" OR process_name="lockscreencontentserver.exe"
+  OR process_name="logonui.exe" OR process_name="lsaiso.exe" OR process_name="mdeserver.exe"
+  OR process_name="mdmagent.exe" OR process_name="mdmappinstaller.exe" OR process_name="mrinfo.exe"
+  OR process_name="mrt.exe" OR process_name="mschedexe.exe" OR process_name="magnify.exe"
+  OR process_name="mbaeparsertask.exe" OR process_name="mdres.exe" OR process_name="mdsched.exe"
+  OR process_name="migautoplay.exe" OR process_name="mpsigstub.exe" OR process_name="msspellcheckinghost.exe"
+  OR process_name="muiunattend.exe" OR process_name="multidigimon.exe" OR process_name="musnotification.exe"
+  OR process_name="musnotificationux.exe" OR process_name="napstat.exe" OR process_name="netstat.exe"
+  OR process_name="narrator.exe" OR process_name="netcfgnotifyobjecthost.exe" OR process_name="netevtfwdr.exe"
+  OR process_name="netproj.exe" OR process_name="netplwiz.exe" OR process_name="networkuxbroker.exe";
+
+  $cond_2 = | from $ssa_input | where process_name="openwith.exe" OR process_name="optionalfeatures.exe"
+  OR process_name="pathping.exe" OR process_name="ping.exe" OR process_name="passwordonwakesettingflyout.exe"
+  OR process_name="pickerhost.exe" OR process_name="pkgmgr.exe" OR process_name="pnpunattend.exe"
+  OR process_name="pnputil.exe" OR process_name="presentationhost.exe" OR process_name="presentationsettings.exe"
+  OR process_name="printbrmui.exe" OR process_name="printdialoghost.exe" OR process_name="printdialoghost3d.exe"
+  OR process_name="printisolationhost.exe" OR process_name="proximityuxhost.exe" OR
+  process_name="rdspnf.exe" OR process_name="rmactivate.exe" OR process_name="rmactivate_isv.exe"
+  OR process_name="rmactivate_ssp.exe" OR process_name="rmactivate_ssp_isv.exe" OR
+  process_name="route.exe" OR process_name="rdpsa.exe" OR process_name="rdpsaproxy.exe"
+  OR process_name="rdpsauachelper.exe" OR process_name="reagentc.exe" OR process_name="recoverydrive.exe"
+  OR process_name="register-cimprovider.exe" OR process_name="registeriepkeys.exe"
+  OR process_name="relpost.exe" OR process_name="remoteposworker.exe" OR process_name="rmclient.exe"
+  OR process_name="robocopy.exe" OR process_name="rpcping.exe" OR process_name="runlegacycplelevated.exe"
+  OR process_name="runtimebroker.exe" OR process_name="sihclient.exe" OR process_name="searchfilterhost.exe"
+  OR process_name="searchindexer.exe" OR process_name="searchprotocolhost.exe" OR
+  process_name="secedit.exe" OR process_name="sensordataservice.exe" OR process_name="setieinstalleddate.exe"
+  OR process_name="settingsynchost.exe" OR process_name="slidetoshutdown.exe" OR process_name="smartscreensettings.exe"
+  OR process_name="sndvol.exe" OR process_name="snippingtool.exe" OR process_name="soundrecorder.exe"
+  OR process_name="spaceagent.exe" OR process_name="sppextcomobj.exe" OR process_name="srtasks.exe"
+  OR process_name="stikynot.exe" OR process_name="synchost.exe" OR process_name="sysreseterr.exe"
+  OR process_name="systempropertiesadvanced.exe" OR process_name="systempropertiescomputername.exe"
+  OR process_name="systempropertiesdataexecutionprevention.exe" OR process_name="systempropertieshardware.exe"
+  OR process_name="systempropertiesperformance.exe" OR process_name="systempropertiesprotection.exe"
+  OR process_name="systempropertiesremote.exe" OR process_name="systemsettingsadminflows.exe"
+  OR process_name="systemsettingsbroker.exe" OR process_name="systemsettingsremovedevice.exe"
+  OR process_name="tcpsvcs.exe" OR process_name="tracert.exe" OR process_name="tstheme.exe"
+  OR process_name="tswbprxy.exe" OR process_name="tapiunattend.exe" OR process_name="taskmgr.exe"
+  OR process_name="thumbnailextractionhost.exe" OR process_name="tokenbrokercookies.exe"
+  OR process_name="tpminit.exe" OR process_name="tswpfwrp.exe" OR process_name="ui0detect.exe"
+  OR process_name="upgraderesultsui.exe" OR process_name="useraccountbroker.exe" OR
+  process_name="useraccountcontrolsettings.exe" OR process_name="usoclient.exe" OR
+  process_name="utilman.exe" OR process_name="vssvc.exe" OR process_name="vaultcmd.exe"
+  OR process_name="vaultsysui.exe" OR process_name="wfs.exe" OR process_name="wmpdmc.exe"
+  OR process_name="wpdshextautoplay.exe" OR process_name="wscollect.exe" OR process_name="wsmanhttpconfig.exe"
+  OR process_name="wsreset.exe" OR process_name="wudfhost.exe" OR process_name="wwahost.exe"
+  OR process_name="wallpaperhost.exe" OR process_name="webcache.exe" OR process_name="werfault.exe"
+  OR process_name="werfaultsecure.exe" OR process_name="winsat.exe" OR process_name="windows.media.backgroundplayback.exe"
+  OR process_name="windowsactiondialog.exe" OR process_name="windowsanytimeupgrade.exe"
+  OR process_name="windowsanytimeupgraderesults.exe";
+
+  $cond_3 = | from $ssa_input | where process_name="windowsanytimeupgradeui.exe" OR
+  process_name="windowsupdateelevatedinstaller.exe" OR process_name="workfolders.exe"
+  OR process_name="wpcmon.exe" OR process_name="acu.exe" OR process_name="aitagent.exe"
+  OR process_name="aitstatic.exe" OR process_name="alg.exe" OR process_name="appidcertstorecheck.exe"
+  OR process_name="appidpolicyconverter.exe" OR process_name="at.exe" OR process_name="attrib.exe"
+  OR process_name="audiodg.exe" OR process_name="auditpol.exe" OR process_name="autochk.exe"
+  OR process_name="autoconv.exe" OR process_name="autofmt.exe" OR process_name="baaupdate.exe"
+  OR process_name="backgroundtaskhost.exe" OR process_name="bcastdvr.exe" OR process_name="bcdboot.exe"
+  OR process_name="bcdedit.exe" OR process_name="bdechangepin.exe" OR process_name="bdeunlock.exe"
+  OR process_name="bitsadmin.exe" OR process_name="bootcfg.exe" OR process_name="bootim.exe"
+  OR process_name="bootsect.exe" OR process_name="bridgeunattend.exe" OR process_name="browser_broker.exe"
+  OR process_name="bthudtask.exe" OR process_name="cacls.exe" OR process_name="calc.exe"
+  OR process_name="cdpreference.exe" OR process_name="certreq.exe" OR process_name="certutil.exe"
+  OR process_name="change.exe" OR process_name="changepk.exe" OR process_name="charmap.exe"
+  OR process_name="chglogon.exe" OR process_name="chgport.exe" OR process_name="chgusr.exe"
+  OR process_name="chkdsk.exe" OR process_name="chkntfs.exe" OR process_name="choice.exe"
+  OR process_name="cipher.exe" OR process_name="cleanmgr.exe" OR process_name="cliconfg.exe"
+  OR process_name="clip.exe" OR process_name="cmd.exe" OR process_name="cmdkey.exe"
+  OR process_name="cmdl32.exe" OR process_name="cmmon32.exe" OR process_name="cmstp.exe"
+  OR process_name="cofire.exe" OR process_name="colorcpl.exe" OR process_name="comp.exe"
+  OR process_name="compact.exe" OR process_name="conhost.exe" OR process_name="consent.exe"
+  OR process_name="control.exe" OR process_name="convert.exe" OR process_name="credwiz.exe"
+  OR process_name="cscript.exe" OR process_name="csrss.exe" OR process_name="ctfmon.exe"
+  OR process_name="cttune.exe" OR process_name="cttunesvr.exe" OR process_name="dashost.exe"
+  OR process_name="dccw.exe" OR process_name="dcomcnfg.exe" OR process_name="ddodiag.exe"
+  OR process_name="dfrgui.exe" OR process_name="dialer.exe" OR process_name="diantz.exe"
+  OR process_name="dinotify.exe" OR process_name="diskpart.exe" OR process_name="diskperf.exe"
+  OR process_name="diskraid.exe" OR process_name="dispdiag.exe" OR process_name="djoin.exe"
+  OR process_name="dllhost.exe" OR process_name="dllhst3g.exe" OR process_name="dmcertinst.exe"
+  OR process_name="dmcfghost.exe" OR process_name="dmclient.exe" OR process_name="dnscacheugc.exe"
+  OR process_name="doskey.exe" OR process_name="dpapimig.exe" OR process_name="dpnsvr.exe"
+  OR process_name="driverquery.exe" OR process_name="drvcfg.exe" OR process_name="drvinst.exe"
+  OR process_name="dsregcmd.exe" OR process_name="dstokenclean.exe" OR process_name="dvdplay.exe"
+  OR process_name="dvdupgrd.exe" OR process_name="dwm.exe" OR process_name="dxdiag.exe"
+  OR process_name="easinvoker.exe" OR process_name="efsui.exe";
+
+  $cond_4 = | from $ssa_input | where process_name="embeddedapplauncher.exe" OR process_name="esentutl.exe"
+  OR process_name="eudcedit.exe" OR process_name="eventcreate.exe" OR process_name="eventvwr.exe"
+  OR process_name="expand.exe" OR process_name="extrac32.exe" OR process_name="fc.exe"
+  OR process_name="fhmanagew.exe" OR process_name="find.exe" OR process_name="findstr.exe"
+  OR process_name="finger.exe" OR process_name="fixmapi.exe" OR process_name="fltmc.exe"
+  OR process_name="fodhelper.exe" OR process_name="fontdrvhost.exe" OR process_name="fontview.exe"
+  OR process_name="forfiles.exe" OR process_name="fsavailux.exe" OR process_name="fsquirt.exe"
+  OR process_name="fsutil.exe" OR process_name="ftp.exe" OR process_name="fvenotify.exe"
+  OR process_name="fveprompt.exe" OR process_name="getmac.exe" OR process_name="gpresult.exe"
+  OR process_name="gpscript.exe" OR process_name="gpupdate.exe" OR process_name="grpconv.exe"
+  OR process_name="hdwwiz.exe" OR process_name="help.exe" OR process_name="hwrcomp.exe"
+  OR process_name="hwrreg.exe" OR process_name="icacls.exe" OR process_name="icardagt.exe"
+  OR process_name="icsunattend.exe" OR process_name="ie4uinit.exe" OR process_name="ieunatt.exe"
+  OR process_name="ieetwcollector.exe" OR process_name="iexpress.exe" OR process_name="immersivetpmvscmgrsvr.exe"
+  OR process_name="ipconfig.exe" OR process_name="irftp.exe" OR process_name="iscsicli.exe"
+  OR process_name="iscsicpl.exe" OR process_name="isoburn.exe" OR process_name="klist.exe"
+  OR process_name="ksetup.exe" OR process_name="ktmutil.exe" OR process_name="label.exe"
+  OR process_name="licensingdiag.exe" OR process_name="lodctr.exe" OR process_name="logagent.exe"
+  OR process_name="logman.exe" OR process_name="logoff.exe" OR process_name="lpkinstall.exe"
+  OR process_name="lpksetup.exe" OR process_name="lpremove.exe" OR process_name="lsass.exe"
+  OR process_name="lsm.exe" OR process_name="makecab.exe" OR process_name="manage-bde.exe"
+  OR process_name="mblctr.exe" OR process_name="mcbuilder.exe" OR process_name="mctadmin.exe"
+  OR process_name="mfpmp.exe" OR process_name="mmc.exe" OR process_name="mobsync.exe"
+  OR process_name="mountvol.exe" OR process_name="mpnotify.exe" OR process_name="msconfig.exe"
+  OR process_name="msdt.exe" OR process_name="msdtc.exe" OR process_name="msfeedssync.exe"
+  OR process_name="msg.exe" OR process_name="mshta.exe" OR process_name="msiexec.exe"
+  OR process_name="msinfo32.exe" OR process_name="mspaint.exe" OR process_name="msra.exe"
+  OR process_name="mstsc.exe" OR process_name="mtstocom.exe" OR process_name="nbtstat.exe"
+  OR process_name="ndadmin.exe" OR process_name="net.exe" OR process_name="net1.exe"
+  OR process_name="netbtugc.exe" OR process_name="netcfg.exe" OR process_name="netiougc.exe"
+  OR process_name="netsh.exe" OR process_name="newdev.exe" OR process_name="nltest.exe"
+  OR process_name="notepad.exe" OR process_name="nslookup.exe" OR process_name="ntoskrnl.exe"
+  OR process_name="ntprint.exe" OR process_name="ocsetup.exe" OR process_name="odbcad32.exe"
+  OR process_name="odbcconf.exe" OR process_name="omadmclient.exe" OR process_name="omadmprc.exe";
+
+  $cond_5 = | from $ssa_input | where process_name="openfiles.exe" OR process_name="osk.exe"
+  OR process_name="p2phost.exe" OR process_name="pcalua.exe" OR process_name="pcaui.exe"
+  OR process_name="pcawrk.exe" OR process_name="pcwrun.exe" OR process_name="perfmon.exe"
+  OR process_name="phoneactivate.exe" OR process_name="plasrv.exe" OR process_name="poqexec.exe"
+  OR process_name="powercfg.exe" OR process_name="prevhost.exe" OR process_name="print.exe"
+  OR process_name="printfilterpipelinesvc.exe" OR process_name="printui.exe" OR process_name="proquota.exe"
+  OR process_name="provtool.exe" OR process_name="psr.exe" OR process_name="pwlauncher.exe"
+  OR process_name="qappsrv.exe" OR process_name="qprocess.exe" OR process_name="query.exe"
+  OR process_name="quser.exe" OR process_name="qwinsta.exe" OR process_name="rasautou.exe"
+  OR process_name="rasdial.exe" OR process_name="raserver.exe" OR process_name="rasphone.exe"
+  OR process_name="rdpclip.exe" OR process_name="rdpinput.exe" OR process_name="rdrleakdiag.exe"
+  OR process_name="recdisc.exe" OR process_name="recover.exe" OR process_name="reg.exe"
+  OR process_name="regedt32.exe" OR process_name="regini.exe" OR process_name="regsvr32.exe"
+  OR process_name="rekeywiz.exe" OR process_name="relog.exe" OR process_name="repair-bde.exe"
+  OR process_name="replace.exe" OR process_name="reset.exe" OR process_name="resmon.exe"
+  OR process_name="rmttpmvscmgrsvr.exe" OR process_name="rrinstaller.exe" OR process_name="rstrui.exe"
+  OR process_name="runas.exe" OR process_name="rundll32.exe" OR process_name="runonce.exe"
+  OR process_name="rwinsta.exe" OR process_name="sbunattend.exe" OR process_name="sc.exe"
+  OR process_name="schtasks.exe" OR process_name="sdbinst.exe" OR process_name="sdchange.exe"
+  OR process_name="sdclt.exe" OR process_name="sdiagnhost.exe" OR process_name="secinit.exe"
+  OR process_name="services.exe" OR process_name="sessionmsg.exe" OR process_name="sethc.exe"
+  OR process_name="setspn.exe" OR process_name="setupcl.exe" OR process_name="setupugc.exe"
+  OR process_name="setx.exe" OR process_name="sfc.exe" OR process_name="shadow.exe"
+  OR process_name="shrpubw.exe" OR process_name="shutdown.exe" OR process_name="sigverif.exe"
+  OR process_name="sihost.exe" OR process_name="slui.exe" OR process_name="smss.exe"
+  OR process_name="snmptrap.exe" OR process_name="sort.exe" OR process_name="spinstall.exe"
+  OR process_name="spoolsv.exe" OR process_name="sppsvc.exe" OR process_name="spreview.exe"
+  OR process_name="srdelayed.exe" OR process_name="subst.exe" OR process_name="svchost.exe"
+  OR process_name="sxstrace.exe" OR process_name="syskey.exe" OR process_name="systeminfo.exe"
+  OR process_name="systemreset.exe" OR process_name="systray.exe" OR process_name="tabcal.exe"
+  OR process_name="takeown.exe" OR process_name="taskeng.exe" OR process_name="taskhost.exe"
+  OR process_name="taskhostw.exe" OR process_name="taskkill.exe" OR process_name="tasklist.exe"
+  OR process_name="taskmgr.exe" OR process_name="tcmsetup.exe" OR process_name="timeout.exe"
+  OR process_name="tpmvscmgr.exe" OR process_name="tpmvscmgrsvr.exe";
+
+  $cond_6 = | from $ssa_input | where process_name="tracerpt.exe" OR process_name="tscon.exe"
+  OR process_name="tsdiscon.exe" OR process_name="tskill.exe" OR process_name="typeperf.exe"
+  OR process_name="tzsync.exe" OR process_name="tzutil.exe" OR process_name="ucsvc.exe"
+  OR process_name="unlodctr.exe" OR process_name="unregmp2.exe" OR process_name="upnpcont.exe"
+  OR process_name="userinit.exe" OR process_name="vds.exe" OR process_name="vdsldr.exe"
+  OR process_name="verclsid.exe" OR process_name="verifier.exe" OR process_name="verifiergui.exe"
+  OR process_name="vmicsvc.exe" OR process_name="vssadmin.exe" OR process_name="w32tm.exe"
+  OR process_name="waitfor.exe" OR process_name="wbadmin.exe" OR process_name="wbengine.exe"
+  OR process_name="wecutil.exe" OR process_name="wermgr.exe" OR process_name="wevtutil.exe"
+  OR process_name="wextract.exe" OR process_name="where.exe" OR process_name="whoami.exe"
+  OR process_name="wiaacmgr.exe" OR process_name="wiawow64.exe" OR process_name="wifitask.exe"
+  OR process_name="wimserv.exe" OR process_name="wininit.exe" OR process_name="winload.exe"
+  OR process_name="winlogon.exe" OR process_name="winresume.exe" OR process_name="winrs.exe"
+  OR process_name="winrshost.exe" OR process_name="winver.exe" OR process_name="wisptis.exe"
+  OR process_name="wkspbroker.exe" OR process_name="wksprt.exe" OR process_name="wlanext.exe"
+  OR process_name="wlrmdr.exe" OR process_name="wowreg32.exe" OR process_name="wpnpinst.exe"
+  OR process_name="wpr.exe" OR process_name="write.exe" OR process_name="wscript.exe"
+  OR process_name="wsmprovhost.exe" OR process_name="wsqmcons.exe" OR process_name="wuapihost.exe"
+  OR process_name="wuapp.exe" OR process_name="wuauclt.exe" OR process_name="wusa.exe"
+  OR process_name="xcopy.exe" OR process_name="xpsrchvw.exe" OR process_name="xwizard.exe";
+
+  | from $cond_1 | union $cond_2 | union $cond_3 | union $cond_4 | union $cond_5 |
+  union $cond_6 | where match_regex(process_path, /(?i)\\windows\\system32/)=false
+  AND match_regex(process_path, /(?i)\\windows\\syswow64/)=false | eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(device, user), body=create_map(["event_id",
+  event_id, "process_path", process_path, "process_name", process_name]) | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Windows Defense Evasion Tactics
+  - Masquerading - Rename System Utilities
+  cis20:
+  - CIS 8
+  confidence: 80
+  context:
+  - source:endpoint
+  - stage: Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/windows-security.log
+  impact: 70
+  kill_chain_phases:
+  - Actions on Objectives
+  message: A system process $process_name$ with commandline $cmd_line$ spawn in non-default
+    folder path in host $dest_device_id$
+  mitre_attack_id:
+  - T1036
+  nist:
+  - PR.PT
+  - DE.CM
+  observable:
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: dest_user_id
+    role:
+    - Victim
+    type: user
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - dest_device_id
+  - process_name
+  - _time
+  - dest_user_id
+  - process_path
+  risk_score: 56
+  risk_severity: low
+  security_domain: endpoint
+type: Anomaly
+version: 3
diff --git a/dist/ssa/detections/unusually_long_command_line.yml b/dist/ssa/detections/unusually_long_command_line.yml
new file mode 100644
index 0000000000..c5b719e75c
--- /dev/null
+++ b/dist/ssa/detections/unusually_long_command_line.yml
@@ -0,0 +1,75 @@
+author: Ignacio Bermudez Corrales, Splunk
+datamodel: []
+date: '2020-10-06'
+description: Command lines that are extremely long may be indicative of malicious
+  activity on your hosts. This search leverages the Splunk Streaming ML DSP plugin
+  to help identify command lines with lengths that are unusual for a given user. This
+  detection is inspired on Unusually Long Command Line authored by Rico Valdez.
+how_to_implement: You must be ingesting sysmon endpoint data that monitors command
+  lines.
+id: 58f43aba-1775-445e-b19c-be2b87d83ae3
+known_false_positives: This detection may flag suspiciously long command lines when
+  there is not sufficient evidence (samples) for a given process that this detection
+  is tracking; or when there is high variability in the length of the command line
+  for the tracked process. Also, some legitimate applications may use long command
+  lines. Such is the case of Ansible, that encodes Powershell scripts using long base64.
+  Attackers may use this technique to obfuscate their payloads.
+name: Unusually Long Command Line
+product:
+- Splunk Behavioral Analytics
+references: []
+risk_message: A  process $process_name$ with a long commandline $cmd_line$ executed
+  in host $dest_device_id$
+search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)) | eval cmd_line=ucast(map_get(input_event, "process"),
+  "string", null), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string",
+  null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null),
+  process_name=ucast(map_get(input_event, "process_name"), "string", null), event_id=ucast(map_get(input_event,
+  "event_id"), "string", null) | where cmd_line!=null and dest_user_id!=null | eval
+  cmd_line_norm=replace(cast(cmd_line, "string"), /\s(--?\w+)|(\/\w+)/, " ARG"), cmd_line_norm=replace(cmd_line_norm,
+  /\w:\\[^\s]+/, "PATH"), cmd_line_norm=replace(cmd_line_norm, /\d+/, "N"), input=parse_double(len(coalesce(cmd_line_norm,
+  ""))) | select timestamp, process_name, dest_device_id, dest_user_id, cmd_line,
+  input | adaptive_threshold algorithm="quantile" entity="process_name" window=60480000
+  | where label AND quantile>0.99 | first_time_event input_columns=["dest_device_id",
+  "cmd_line"] | where first_time_dest_device_id_cmd_line | eval start_time = timestamp,
+  end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body=create_map(["event_id",
+  event_id, "cmd_line", cmd_line, "process_name", process_name]) | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Unusual Processes
+  cis20:
+  - CIS 8
+  confidence: 40
+  context:
+  - source:endpoint
+  - stage: Defense Evasion
+  impact: 30
+  kill_chain_phases:
+  - Actions on Objectives
+  message: A  process $process_name$ with a long commandline $cmd_line$ executed in
+    host $dest_device_id$
+  nist:
+  - PR.PT
+  - DE.CM
+  observable:
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: dest_user_id
+    role:
+    - Victim
+    type: user
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - process_name
+  - _time
+  - dest_device_id
+  - dest_user_id
+  - process
+  risk_score: 12
+  risk_severity: medium
+  security_domain: endpoint
+type: Anomaly
+version: 1
diff --git a/dist/ssa/detections/wevtutil_usage_to_clear_logs.yml b/dist/ssa/detections/wevtutil_usage_to_clear_logs.yml
new file mode 100644
index 0000000000..32b1e15fbb
--- /dev/null
+++ b/dist/ssa/detections/wevtutil_usage_to_clear_logs.yml
@@ -0,0 +1,85 @@
+author: Teoderick Contreras, Splunk
+datamodel:
+- Endpoint
+date: '2021-06-15'
+description: The wevtutil.exe application is the windows event log utility. This searches
+  for wevtutil.exe with parameters for clearing the application, security, setup,
+  powershell, sysmon, or system event logs.
+how_to_implement: You must be ingesting data that records process activity from your
+  hosts to populate the Endpoint data model in the Processes node. You must also be
+  ingesting logs with both the process name and command line from your endpoints.
+  The command-line arguments are mapped to the "process" field in the Endpoint data
+  model.
+id: 5438113c-cdd9-11eb-93b8-acde48001122
+known_false_positives: The wevtutil.exe application is a legitimate Windows event
+  log utility. Administrators may use it to manage Windows event logs.
+name: WevtUtil Usage To Clear Logs
+product:
+- Splunk Behavioral Analytics
+references:
+- https://www.splunk.com/en_us/blog/security/detecting-clop-ransomware.html
+risk_message: A wevtutil process $process_name$ with commandline $cmd_line$ to clear
+  event logs in host $dest_device_id$
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
+  null), process_name=ucast(map_get(input_event, "process_name"), "string", null),
+  process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event,
+  "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"),
+  "string", null) | where cmd_line IS NOT NULL AND like(cmd_line, "% cl %") AND (match_regex(cmd_line,
+  /(?i)security/)=true OR match_regex(cmd_line, /(?i)system/)=true OR match_regex(cmd_line,
+  /(?i)sysmon/)=true OR match_regex(cmd_line, /(?i)application/)=true OR match_regex(cmd_line,
+  /(?i)setup/)=true OR match_regex(cmd_line, /(?i)powershell/)=true) AND process_name="wevtutil.exe"
+  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name, "parent_process_name", parent_process_name, "process_path", process_path])
+  | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Windows Log Manipulation
+  - Ransomware
+  - Clop Ransomware
+  cis20:
+  - CIS 8
+  - CIS 13
+  confidence: 90
+  context:
+  - source:endpoint
+  - stage: Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/clear_evt.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: A wevtutil process $process_name$ with commandline $cmd_line$ to clear
+    event logs in host $dest_device_id$
+  mitre_attack_id:
+  - T1070
+  - T1070.001
+  nist:
+  - PR.DS
+  - PR.IP
+  observable:
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: dest_user_id
+    role:
+    - Victim
+    type: user
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  risk_score: 63
+  risk_severity: low
+  security_domain: endpoint
+type: TTP
+version: 2
diff --git a/dist/ssa/detections/wevtutil_usage_to_disable_logs.yml b/dist/ssa/detections/wevtutil_usage_to_disable_logs.yml
new file mode 100644
index 0000000000..9c20f4a7af
--- /dev/null
+++ b/dist/ssa/detections/wevtutil_usage_to_disable_logs.yml
@@ -0,0 +1,81 @@
+author: Teoderick Contreras, Splunk
+datamodel:
+- Endpoint
+date: '2021-06-15'
+description: This search is to detect execution of wevtutil.exe to disable logs. This
+  technique was seen in several ransomware to disable the event logs to evade alerts
+  and detections in compromised host.
+how_to_implement: You must be ingesting data that records process activity from your
+  hosts to populate the Endpoint data model in the Processes node. You must also be
+  ingesting logs with both the process name and command line from your endpoints.
+  The command-line arguments are mapped to the "process" field in the Endpoint data
+  model.
+id: a4bdc944-cdd9-11eb-ac97-acde48001122
+known_false_positives: network operator may disable audit event logs for debugging
+  purposes.
+name: Wevtutil Usage To Disable Logs
+product:
+- Splunk Behavioral Analytics
+references:
+- https://www.bleepingcomputer.com/news/security/new-ransom-x-ransomware-used-in-texas-txdot-cyberattack/
+risk_message: A wevtutil process $process_name$ with commandline $cmd_line$ to disable
+  event logs in host $dest_device_id$
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
+  null), process_name=ucast(map_get(input_event, "process_name"), "string", null),
+  process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event,
+  "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"),
+  "string", null) | where cmd_line IS NOT NULL AND like(cmd_line, "% sl %") AND like(cmd_line,
+  "%/e:false%") AND process_name="wevtutil.exe" | eval start_time=timestamp, end_time=timestamp,
+  entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
+  "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line",
+  cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
+  "process_path", process_path]) | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Windows Log Manipulation
+  - Ransomware
+  cis20:
+  - CIS 8
+  - CIS 13
+  confidence: 90
+  context:
+  - source:endpoint
+  - stage: Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/disable_evt.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: A wevtutil process $process_name$ with commandline $cmd_line$ to disable
+    event logs in host $dest_device_id$
+  mitre_attack_id:
+  - T1070
+  - T1070.001
+  nist:
+  - PR.DS
+  - PR.IP
+  observable:
+  - name: dest_device_id
+    role:
+    - Victim
+    type: Hostname
+  - name: dest_user_id
+    role:
+    - Victim
+    type: user
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  risk_score: 63
+  risk_severity: low
+  security_domain: endpoint
+type: TTP
+version: 2