small bug

2026-06-08 17:32:49 +00:00 · 2020-05-25 16:46:38 +02:00
parent 086209ae42
commit fd024fb4c0
9 changed files with 492 additions and 492 deletions
@@ -29,7 +29,7 @@ narrative = {{ story.narrative }}
 {% for detection in detections %}
 [savedsearch://ESCU - {{ detection.name }} - Rule]
 type = detection
-asset_type = {{ detection.asset_type }}
+asset_type = {{ detection.tags.asset_type }}
 confidence = medium
 explanation = {{ detection.description }}
 {% if detection.how_to_implement is defined %}
@@ -44,58 +44,58 @@ T1482,Domain Trust Discovery,Discovery,no
 T1480,Execution Guardrails,Defense Evasion,APT33|Equation
 T1223,Compiled HTML File,Defense Evasion|Execution,APT41|Silence|Lazarus Group|Dark Caracal|OilRig
 T1222,File and Directory Permissions Modification,Defense Evasion,APT32
-T1221,Template Injection,Defense Evasion,APT28|Tropic Trooper|Dragonfly 2.0|DarkHydrus
 T1220,XSL Script Processing,Defense Evasion|Execution,Cobalt Group
+T1221,Template Injection,Defense Evasion,APT28|Tropic Trooper|Dragonfly 2.0|DarkHydrus
 T1197,BITS Jobs,Defense Evasion|Persistence,Leviathan
-T1217,Browser Bookmark Discovery,Discovery,no
 T1191,CMSTP,Defense Evasion|Execution,Cobalt Group|MuddyWater
 T1196,Control Panel Items,Defense Evasion|Execution,no
 T1214,Credentials in Registry,Credential Access,Soft Cell
 T1207,DCShadow,Defense Evasion,no
 T1213,Data from Information Repositories,Collection,Ke3chang|APT28
-T1189,Drive-by Compromise,Initial Access,Darkhotel|APT38|Lazarus Group|Dragonfly 2.0|BRONZE BUTLER|Leafminer|Dark Caracal|APT32|Threat Group-3390|APT19|Elderwood|APT37|Patchwork|PLATINUM
-T1190,Exploit Public-Facing Application,Initial Access,Soft Cell|Night Dragon|Axiom
 T1212,Exploitation for Credential Access,Credential Access,no
-T1211,Exploitation for Defense Evasion,Defense Evasion,APT28
-T1203,Exploitation for Client Execution,Execution,APT41|admin@338|Threat Group-3390|APT12|The White Company|APT33|APT32|APT28|Tropic Trooper|BRONZE BUTLER|Lazarus Group|Cobalt Group|APT37|APT29|Patchwork|Leviathan|Elderwood|TA459
+T1217,Browser Bookmark Discovery,Discovery,no
+T1190,Exploit Public-Facing Application,Initial Access,Soft Cell|Night Dragon|Axiom
 T1210,Exploitation of Remote Services,Lateral Movement,Threat Group-3390|APT28
 T1200,Hardware Additions,Initial Access,no
-T1202,Indirect Command Execution,Defense Evasion,no
+T1189,Drive-by Compromise,Initial Access,Darkhotel|APT38|Lazarus Group|Dragonfly 2.0|BRONZE BUTLER|Leafminer|APT19|Dark Caracal|Threat Group-3390|APT32|Elderwood|Patchwork|APT37|PLATINUM
+T1211,Exploitation for Defense Evasion,Defense Evasion,APT28
+T1203,Exploitation for Client Execution,Execution,APT41|admin@338|Threat Group-3390|APT12|The White Company|APT33|APT32|APT28|Tropic Trooper|BRONZE BUTLER|Lazarus Group|Cobalt Group|APT37|APT29|Patchwork|Leviathan|TA459|Elderwood
 T1208,Kerberoasting,Credential Access,no
 T1215,Kernel Modules and Extensions,Persistence,no
 T1201,Password Policy Discovery,Discovery,OilRig
 T1205,Port Knocking,Defense Evasion|Persistence|Command And Control,no
-T1219,Remote Access Tools,Command And Control,Kimsuky|Night Dragon|Thrip|Cobalt Group|Carbanak
 T1198,SIP and Trust Provider Hijacking,Defense Evasion|Persistence,no
 T1218,Signed Binary Proxy Execution,Defense Evasion|Execution,TA505|Rancor|Cobalt Group
-T1216,Signed Script Proxy Execution,Defense Evasion|Execution,APT32
-T1193,Spearphishing Attachment,Initial Access,APT41|Machete|admin@338|Kimsuky|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|Tropic Trooper|Turla|Gorgon Group|Rancor|DarkHydrus|Lazarus Group|Cobalt Group|BRONZE BUTLER|OilRig|FIN7|APT19|Dragonfly 2.0|APT32|FIN8|MuddyWater|APT28|TA459|Elderwood|APT29|APT37|Patchwork|Leviathan|Magic Hound|menuPass|PLATINUM
+T1202,Indirect Command Execution,Defense Evasion,no
 T1194,Spearphishing via Service,Initial Access,FIN6|OilRig|Dark Caracal|Magic Hound
-T1192,Spearphishing Link,Initial Access,Machete|Kimsuky|TA505|Stolen Pencil|APT39|FIN4|APT32|Night Dragon|APT28|Turla|Cobalt Group|Dragonfly 2.0|OilRig|APT33|Elderwood|Patchwork|Magic Hound|APT29|Leviathan|FIN8
-T1206,Sudo Caching,Privilege Escalation,no
 T1195,Supply Chain Compromise,Initial Access,APT41|Elderwood
+T1219,Remote Access Tools,Command And Control,Kimsuky|Night Dragon|Thrip|Cobalt Group|Carbanak
+T1216,Signed Script Proxy Execution,Defense Evasion|Execution,APT32
+T1193,Spearphishing Attachment,Initial Access,APT41|Machete|admin@338|Kimsuky|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|Tropic Trooper|Turla|Gorgon Group|Rancor|DarkHydrus|Lazarus Group|Cobalt Group|OilRig|APT19|FIN7|BRONZE BUTLER|Dragonfly 2.0|APT32|FIN8|MuddyWater|APT28|TA459|Elderwood|APT29|APT37|Patchwork|Leviathan|menuPass|Magic Hound|PLATINUM
 T1209,Time Providers,Persistence,no
+T1204,User Execution,Execution,Machete|admin@338|APT12|TA505|Silence|The White Company|APT39|FIN4|Night Dragon|Darkhotel|Gallmaker|Dragonfly 2.0|APT33|APT19|BRONZE BUTLER|Dark Caracal|Cobalt Group|FIN7|DarkHydrus|Turla|Gorgon Group|OilRig|MuddyWater|Patchwork|Lazarus Group|APT32|Rancor|APT37|APT28|APT29|menuPass|FIN8|TA459|Elderwood|Leviathan|Magic Hound|PLATINUM
+T1192,Spearphishing Link,Initial Access,Machete|Kimsuky|TA505|Stolen Pencil|APT39|FIN4|APT32|Night Dragon|APT28|Turla|Cobalt Group|Dragonfly 2.0|OilRig|APT33|Elderwood|APT29|Leviathan|Patchwork|Magic Hound|FIN8
+T1206,Sudo Caching,Privilege Escalation,no
 T1199,Trusted Relationship,Initial Access,APT28|menuPass
-T1204,User Execution,Execution,Machete|admin@338|APT12|TA505|Silence|The White Company|APT39|FIN4|Night Dragon|Darkhotel|Gallmaker|Dragonfly 2.0|APT19|BRONZE BUTLER|APT33|Dark Caracal|Cobalt Group|FIN7|DarkHydrus|Patchwork|Turla|Gorgon Group|Lazarus Group|APT32|Rancor|OilRig|MuddyWater|APT37|APT28|APT29|FIN8|menuPass|Elderwood|PLATINUM|Magic Hound|TA459|Leviathan
 T1182,AppCert DLLs,Persistence|Privilege Escalation,Honeybee
 T1176,Browser Extensions,Persistence,Kimsuky|Stolen Pencil
 T1175,Component Object Model and Distributed COM,Lateral Movement|Execution,MuddyWater
-T1172,Domain Fronting,Command And Control,APT29
-T1173,Dynamic Data Exchange,Execution,TA505|MuddyWater|Gallmaker|Patchwork|Cobalt Group|APT37|APT28|FIN7
 T1181,Extra Window Memory Injection,Defense Evasion|Privilege Escalation,no
-T1187,Forced Authentication,Credential Access,DarkHydrus|Dragonfly 2.0
 T1179,Hooking,Persistence|Privilege Escalation|Credential Access,PLATINUM
-T1183,Image File Execution Options Injection,Privilege Escalation|Persistence|Defense Evasion,TEMP.Veles
+T1172,Domain Fronting,Command And Control,APT29
+T1187,Forced Authentication,Credential Access,DarkHydrus|Dragonfly 2.0
+T1173,Dynamic Data Exchange,Execution,TA505|MuddyWater|Gallmaker|Patchwork|Cobalt Group|APT37|APT28|FIN7
+T1188,Multi-hop Proxy,Command And Control,FIN4|APT29
 T1171,LLMNR/NBT-NS Poisoning and Relay,Credential Access,no
 T1177,LSASS Driver,Execution|Persistence,no
-T1185,Man in the Browser,Collection,no
-T1170,Mshta,Defense Evasion|Execution,Kimsuky|APT32|MuddyWater|FIN7
-T1188,Multi-hop Proxy,Command And Control,FIN4|APT29
 T1174,Password Filter DLL,Credential Access,no
-T1186,Process Doppelgänging,Defense Evasion,no
-T1184,SSH Hijacking,Lateral Movement,no
-T1178,SID-History Injection,Privilege Escalation,no
 T1180,Screensaver,Persistence,no
+T1183,Image File Execution Options Injection,Privilege Escalation|Persistence|Defense Evasion,TEMP.Veles
+T1170,Mshta,Defense Evasion|Execution,Kimsuky|APT32|MuddyWater|FIN7
+T1184,SSH Hijacking,Lateral Movement,no
+T1185,Man in the Browser,Collection,no
+T1186,Process Doppelgänging,Defense Evasion,no
+T1178,SID-History Injection,Privilege Escalation,no
 T1156,.bash_profile and .bashrc,Persistence,no
 T1134,Access Token Manipulation,Defense Evasion|Privilege Escalation,Turla|Lazarus Group|APT28
 T1155,AppleScript,Execution|Lateral Movement,no
@@ -103,35 +103,35 @@ T1138,Application Shimming,Persistence|Privilege Escalation,FIN7
 T1139,Bash History,Credential Access,no
 T1146,Clear Command History,Defense Evasion,APT41
 T1136,Create Account,Persistence,APT41|Soft Cell|Dragonfly 2.0|Leafminer|APT3
-T1140,Deobfuscate/Decode Files or Information,Defense Evasion,Turla|WIRTE|Darkhotel|Tropic Trooper|Honeybee|menuPass|Gorgon Group|Threat Group-3390|APT19|Leviathan|MuddyWater|APT28|OilRig|BRONZE BUTLER
+T1140,Deobfuscate/Decode Files or Information,Defense Evasion,Turla|WIRTE|Darkhotel|Tropic Trooper|Gorgon Group|Honeybee|menuPass|Threat Group-3390|APT19|Leviathan|MuddyWater|APT28|OilRig|BRONZE BUTLER
 T1157,Dylib Hijacking,Persistence|Privilege Escalation,no
-T1144,Gatekeeper Bypass,Defense Evasion,no
 T1148,HISTCONTROL,Defense Evasion,no
 T1147,Hidden Users,Defense Evasion,no
-T1158,Hidden Files and Directories,Defense Evasion|Persistence,APT32|Tropic Trooper|APT28|Lazarus Group
 T1143,Hidden Window,Defense Evasion,Gorgon Group|Deep Panda|DarkHydrus|CopyKittens|APT19|APT32|APT28|APT3|Magic Hound
-T1141,Input Prompt,Credential Access,FIN4
-T1142,Keychain,Credential Access,no
+T1144,Gatekeeper Bypass,Defense Evasion,no
+T1158,Hidden Files and Directories,Defense Evasion|Persistence,APT32|Tropic Trooper|APT28|Lazarus Group
 T1149,LC_MAIN Hijacking,Defense Evasion,no
-T1161,LC_LOAD_DYLIB Addition,Persistence,no
-T1159,Launch Agent,Persistence,no
 T1152,Launchctl,Defense Evasion|Execution|Persistence,no
 T1168,Local Job Scheduling,Persistence|Execution,no
-T1160,Launch Daemon,Persistence|Privilege Escalation,no
+T1141,Input Prompt,Credential Access,FIN4
 T1162,Login Item,Persistence,no
-T1135,Network Share Discovery,Discovery,APT41|Tropic Trooper|APT1|Dragonfly 2.0|Sowbug
 T1137,Office Application Startup,Persistence,APT32|APT28
 T1150,Plist Modification,Defense Evasion|Persistence|Privilege Escalation,no
 T1145,Private Keys,Credential Access,no
 T1163,Rc.common,Persistence,no
+T1142,Keychain,Credential Access,no
+T1159,Launch Agent,Persistence,no
+T1151,Space after Filename,Defense Evasion|Execution,no
+T1161,LC_LOAD_DYLIB Addition,Persistence,no
+T1160,Launch Daemon,Persistence|Privilege Escalation,no
+T1153,Source,Execution,no
+T1154,Trap,Execution|Persistence,no
+T1135,Network Share Discovery,Discovery,APT41|Tropic Trooper|APT1|Dragonfly 2.0|Sowbug
 T1164,Re-opened Applications,Persistence,no
+T1169,Sudo,Privilege Escalation,no
 T1167,Securityd Memory,Credential Access,no
 T1166,Setuid and Setgid,Privilege Escalation|Persistence,no
-T1153,Source,Execution,no
-T1151,Space after Filename,Defense Evasion|Execution,no
 T1165,Startup Items,Persistence|Privilege Escalation,no
-T1169,Sudo,Privilege Escalation,no
-T1154,Trap,Execution|Persistence,no
 T1133,External Remote Services,Persistence|Initial Access,APT41|Soft Cell|TEMP.Veles|Night Dragon|OilRig|Ke3chang|Dragonfly 2.0|FIN5|Threat Group-3390|APT18
 T1132,Data Encoding,Command And Control,APT33|APT19|Lazarus Group|BRONZE BUTLER|Patchwork
 T1131,Authentication Package,Persistence,no
@@ -149,21 +149,21 @@ T1120,Peripheral Device Discovery,Discovery,APT37|Gamaredon Group|Equation|APT28
 T1119,Automated Collection,Collection,APT1|APT28|Patchwork|OilRig|FIN5|Threat Group-3390|FIN6
 T1118,InstallUtil,Defense Evasion|Execution,no
 T1117,Regsvr32,Defense Evasion|Execution,WIRTE|APT19|Cobalt Group|Leviathan|APT32|Deep Panda
-T1116,Code Signing,Defense Evasion,APT41|FIN6|TA505|FIN7|Honeybee|Leviathan|APT37|CopyKittens|Winnti Group|Suckfly|Molerats|Darkhotel
+T1116,Code Signing,Defense Evasion,APT41|FIN6|TA505|FIN7|Honeybee|APT37|Leviathan|CopyKittens|Winnti Group|Suckfly|Molerats|Darkhotel
 T1115,Clipboard Data,Collection,APT38
-T1114,Email Collection,Collection,FIN4|APT28|Dragonfly 2.0|Magic Hound|Ke3chang|Leafminer|APT1
-T1113,Screen Capture,Collection,Silence|MuddyWater|OilRig|Dragonfly 2.0|FIN7|Dark Caracal|BRONZE BUTLER|Magic Hound|Group5|APT28
-T1112,Modify Registry,Defense Evasion,APT41|Turla|APT32|APT38|Dragonfly 2.0|APT19|Gorgon Group|Patchwork|Threat Group-3390|Honeybee|FIN8
+T1114,Email Collection,Collection,FIN4|Dragonfly 2.0|APT28|Magic Hound|Ke3chang|Leafminer|APT1
+T1113,Screen Capture,Collection,Silence|MuddyWater|OilRig|Dragonfly 2.0|Dark Caracal|FIN7|BRONZE BUTLER|Magic Hound|Group5|APT28
+T1112,Modify Registry,Defense Evasion,APT41|Turla|APT32|APT38|Dragonfly 2.0|Threat Group-3390|Patchwork|APT19|Honeybee|Gorgon Group|FIN8
 T1111,Two-Factor Authentication Interception,Credential Access,no
-T1110,Brute Force,Credential Access,APT41|APT33|Leafminer|Dragonfly 2.0|OilRig|APT3|Lazarus Group|Turla
+T1110,Brute Force,Credential Access,APT41|APT33|Leafminer|OilRig|Dragonfly 2.0|APT3|Lazarus Group|Turla
 T1109,Component Firmware,Defense Evasion|Persistence,Equation
 T1108,Redundant Access,Defense Evasion|Persistence,Stolen Pencil|Cobalt Group|Leafminer|APT3|FIN5|OilRig|Threat Group-3390
-T1107,File Deletion,Defense Evasion,APT41|Kimsuky|Silence|The White Company|TEMP.Veles|APT32|APT38|Honeybee|Patchwork|Cobalt Group|Dragonfly 2.0|menuPass|FIN8|OilRig|FIN5|BRONZE BUTLER|Magic Hound|APT3|FIN10|APT28|Threat Group-3390|Group5|Lazarus Group|APT18|APT29
+T1107,File Deletion,Defense Evasion,APT41|Kimsuky|Silence|The White Company|TEMP.Veles|APT32|APT38|Honeybee|Patchwork|Dragonfly 2.0|menuPass|Cobalt Group|FIN8|OilRig|FIN5|BRONZE BUTLER|Magic Hound|APT3|FIN10|Threat Group-3390|APT28|Group5|Lazarus Group|APT18|APT29
 T1106,Execution through API,Execution,Turla|Silence|APT37|Gorgon Group
-T1105,Remote File Copy,Command And Control|Lateral Movement,Soft Cell|TA505|WIRTE|APT33|MuddyWater|APT18|APT38|Cobalt Group|Rancor|Turla|Gorgon Group|OilRig|Dragonfly 2.0|APT37|FIN8|Leviathan|PLATINUM|Elderwood|Magic Hound|APT3|BRONZE BUTLER|APT32|menuPass|FIN7|FIN10|Gamaredon Group|Patchwork|Lazarus Group|Threat Group-3390|APT28
+T1105,Remote File Copy,Command And Control|Lateral Movement,Soft Cell|TA505|WIRTE|APT33|MuddyWater|APT18|APT38|Turla|Rancor|Gorgon Group|Cobalt Group|Dragonfly 2.0|OilRig|APT37|FIN8|PLATINUM|Leviathan|Elderwood|Magic Hound|APT3|APT32|BRONZE BUTLER|FIN7|FIN10|menuPass|Gamaredon Group|Patchwork|Lazarus Group|Threat Group-3390|APT28
 T1104,Multi-Stage Channels,Command And Control,MuddyWater|APT3
 T1103,AppInit DLLs,Persistence|Privilege Escalation,no
-T1102,Web Service,Command And Control|Defense Evasion,APT41|APT12|FIN6|Turla|FIN7|BRONZE BUTLER|APT37|Leviathan|Magic Hound|RTM|Patchwork|Carbanak
+T1102,Web Service,Command And Control|Defense Evasion,APT41|APT12|FIN6|Turla|FIN7|BRONZE BUTLER|Leviathan|APT37|Magic Hound|RTM|Patchwork|Carbanak
 T1101,Security Support Provider,Persistence,no
 T1100,Web Shell,Persistence|Privilege Escalation,Soft Cell|Threat Group-3390|TEMP.Veles|Leviathan|APT39|Dragonfly 2.0|APT32|OilRig|Deep Panda
 T1099,Timestomp,Defense Evasion,TEMP.Veles|APT32|Lazarus Group|APT28
@@ -177,36 +177,36 @@ T1092,Communication Through Removable Media,Command And Control,APT28
 T1091,Replication Through Removable Media,Lateral Movement|Initial Access,Darkhotel|APT28
 T1090,Connection Proxy,Command And Control|Defense Evasion,APT41|Soft Cell|Turla|APT39|MuddyWater|APT3|Lazarus Group|menuPass|Strider|APT28
 T1089,Disabling Security Tools,Defense Evasion,Kimsuky|Turla|Night Dragon|Dragonfly 2.0|Gorgon Group|Threat Group-3390|Lazarus Group|Putter Panda|Carbanak
-T1088,Bypass User Account Control,Defense Evasion|Privilege Escalation,APT37|MuddyWater|Honeybee|Cobalt Group|Threat Group-3390|BRONZE BUTLER|Patchwork|APT29
+T1088,Bypass User Account Control,Defense Evasion|Privilege Escalation,APT37|MuddyWater|Honeybee|Threat Group-3390|Cobalt Group|BRONZE BUTLER|Patchwork|APT29
 T1087,Account Discovery,Discovery,APT32|APT1|Dragonfly 2.0|BRONZE BUTLER|OilRig|Threat Group-3390|menuPass|FIN6|Poseidon Group|APT3|admin@338|Ke3chang
-T1086,PowerShell,Execution,APT41|Kimsuky|Soft Cell|TA505|WIRTE|TEMP.Veles|APT33|Gallmaker|Turla|Thrip|APT19|DarkHydrus|Dragonfly 2.0|Cobalt Group|APT28|Gorgon Group|Leviathan|TA459|MuddyWater|FIN8|CopyKittens|OilRig|Magic Hound|BRONZE BUTLER|APT32|FIN10|FIN7|Threat Group-3390|menuPass|Patchwork|Stealth Falcon|FIN6|Poseidon Group|APT3|APT29|Deep Panda
+T1086,PowerShell,Execution,APT41|Kimsuky|Soft Cell|TA505|WIRTE|TEMP.Veles|APT33|Gallmaker|Turla|DarkHydrus|APT19|APT28|Thrip|Dragonfly 2.0|Cobalt Group|Gorgon Group|Leviathan|TA459|MuddyWater|FIN8|CopyKittens|OilRig|Magic Hound|BRONZE BUTLER|APT32|FIN10|FIN7|Threat Group-3390|menuPass|Patchwork|Stealth Falcon|FIN6|Poseidon Group|APT3|APT29|Deep Panda
 T1085,Rundll32,Defense Evasion|Execution,TA505|MuddyWater|APT29|APT19|CopyKittens|APT3|Carbanak|APT28
 T1084,Windows Management Instrumentation Event Subscription,Persistence,Turla|Leviathan|APT29
-T1083,File and Directory Discovery,Discovery,Kimsuky|APT32|MuddyWater|APT18|Leafminer|Dragonfly 2.0|Dark Caracal|Honeybee|Magic Hound|APT3|BRONZE BUTLER|Sowbug|APT28|Patchwork|Lazarus Group|Dust Storm|admin@338|Turla|Ke3chang
-T1082,System Information Discovery,Discovery,Kimsuky|Tropic Trooper|Darkhotel|MuddyWater|APT18|APT37|Honeybee|APT19|APT32|OilRig|Magic Hound|APT3|Sowbug|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|admin@338|Turla|Ke3chang
+T1083,File and Directory Discovery,Discovery,Kimsuky|APT32|MuddyWater|APT18|Leafminer|Dragonfly 2.0|Honeybee|Dark Caracal|Magic Hound|APT3|Sowbug|BRONZE BUTLER|APT28|Patchwork|Lazarus Group|Dust Storm|admin@338|Turla|Ke3chang
+T1082,System Information Discovery,Discovery,Kimsuky|Tropic Trooper|Darkhotel|MuddyWater|APT18|APT37|Honeybee|APT19|APT32|Magic Hound|OilRig|APT3|Sowbug|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|admin@338|Turla|Ke3chang
 T1081,Credentials in Files,Credential Access,OilRig|Kimsuky|Turla|TA505|Stolen Pencil|MuddyWater|APT3
 T1080,Taint Shared Content,Lateral Movement,Darkhotel
 T1079,Multilayer Encryption,Command And Control,no
-T1078,Valid Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,APT41|Soft Cell|TEMP.Veles|APT39|Stolen Pencil|FIN4|Night Dragon|Dragonfly 2.0|FIN8|APT33|Leviathan|APT3|FIN5|OilRig|menuPass|APT28|APT32|FIN10|Suckfly|FIN6|Threat Group-1314|Threat Group-3390|APT18|PittyTiger|Carbanak
+T1078,Valid Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,APT41|Soft Cell|TEMP.Veles|APT39|Stolen Pencil|FIN4|Night Dragon|Dragonfly 2.0|FIN8|Leviathan|APT33|APT3|FIN5|OilRig|menuPass|APT28|FIN10|APT32|Suckfly|FIN6|Threat Group-1314|Threat Group-3390|APT18|PittyTiger|Carbanak
 T1077,Windows Admin Shares,Lateral Movement,APT32|Orangeworm|FIN8|APT3|Lazarus Group|Threat Group-1314|Turla|Deep Panda|Ke3chang
 T1076,Remote Desktop Protocol,Lateral Movement,APT41|TEMP.Veles|Leviathan|APT39|Stolen Pencil|Cobalt Group|Dragonfly 2.0|FIN8|APT3|OilRig|menuPass|FIN10|Patchwork|FIN6|Lazarus Group|APT1|Axiom
 T1075,Pass the Hash,Lateral Movement,Soft Cell|APT32|Night Dragon|APT28|APT1
 T1074,Data Staged,Collection,Machete|Soft Cell|TEMP.Veles|Night Dragon|Honeybee|Patchwork|Dragonfly 2.0|Leviathan|FIN8|APT3|FIN5|menuPass|FIN6|Lazarus Group|Threat Group-3390|APT28
 T1073,DLL Side-Loading,Defense Evasion,APT41|Soft Cell|Tropic Trooper|Patchwork|APT19|APT32|APT3|menuPass|Threat Group-3390
 T1072,Third-party Software,Execution|Lateral Movement,Threat Group-1314
-T1071,Standard Application Layer Protocol,Command And Control,APT41|Machete|WIRTE|APT33|FIN4|Night Dragon|APT18|SilverTerrier|APT38|Dragonfly 2.0|APT19|Cobalt Group|FIN7|Threat Group-3390|APT37|Orangeworm|Turla|Rancor|Honeybee|Ke3chang|Dark Caracal|Lazarus Group|BRONZE BUTLER|OilRig|APT32|Magic Hound|Gamaredon Group|Stealth Falcon|FIN6|APT28
+T1071,Standard Application Layer Protocol,Command And Control,APT41|Machete|WIRTE|APT33|FIN4|Night Dragon|APT18|SilverTerrier|APT38|Dragonfly 2.0|APT19|Cobalt Group|FIN7|Threat Group-3390|Turla|APT37|Rancor|Orangeworm|Honeybee|Ke3chang|Dark Caracal|Lazarus Group|BRONZE BUTLER|APT32|OilRig|Magic Hound|Gamaredon Group|Stealth Falcon|FIN6|APT28
 T1070,Indicator Removal on Host,Defense Evasion,APT41|APT29|APT38|Dragonfly 2.0|APT32|FIN8|FIN5|APT28
 T1069,Permission Groups Discovery,Discovery,FIN6|Dragonfly 2.0|OilRig|APT3|admin@338|Ke3chang
 T1068,Exploitation for Privilege Escalation,Privilege Escalation,APT33|Cobalt Group|PLATINUM|FIN8|APT32|Threat Group-3390|FIN6|APT28
 T1067,Bootkit,Persistence,APT41|Lazarus Group|APT28
 T1066,Indicator Removal from Tools,Defense Evasion,Soft Cell|TEMP.Veles|Patchwork|APT3|Turla|OilRig|Deep Panda
 T1065,Uncommonly Used Port,Command And Control,TEMP.Veles|APT33|APT32|Gorgon Group|Magic Hound|Group5|Lazarus Group|APT3
-T1064,Scripting,Defense Evasion|Execution,Machete|Turla|TA505|Silence|WIRTE|APT39|FIN4|APT32|Darkhotel|Gallmaker|Dark Caracal|Lazarus Group|menuPass|APT19|Dragonfly 2.0|APT37|Gorgon Group|Leafminer|Rancor|Cobalt Group|FIN7|Honeybee|Ke3chang|Patchwork|MuddyWater|Leviathan|FIN8|TA459|APT28|Magic Hound|OilRig|BRONZE BUTLER|FIN5|FIN10|Gamaredon Group|Stealth Falcon|FIN6|APT3|APT29|Deep Panda|APT1
+T1064,Scripting,Defense Evasion|Execution,Machete|Turla|TA505|Silence|WIRTE|APT39|FIN4|APT32|Darkhotel|Gallmaker|Dark Caracal|Lazarus Group|menuPass|APT19|Dragonfly 2.0|Leafminer|Rancor|Honeybee|APT37|Ke3chang|Cobalt Group|Patchwork|FIN7|Gorgon Group|MuddyWater|Leviathan|FIN8|TA459|APT28|Magic Hound|OilRig|FIN5|BRONZE BUTLER|FIN10|Gamaredon Group|Stealth Falcon|FIN6|APT3|APT29|Deep Panda|APT1
 T1063,Security Software Discovery,Discovery,The White Company|Cobalt Group|Darkhotel|MuddyWater|Tropic Trooper|FIN8|Patchwork|Naikon
 T1062,Hypervisor,Persistence,no
 T1061,Graphical User Interface,Execution,APT3
-T1060,Registry Run Keys / Startup Folder,Persistence,APT41|Machete|Kimsuky|APT33|APT39|APT32|APT18|Turla|APT19|Cobalt Group|Honeybee|Dark Caracal|Ke3chang|Threat Group-3390|Dragonfly 2.0|Gorgon Group|MuddyWater|APT37|Leviathan|BRONZE BUTLER|APT3|Magic Hound|FIN10|FIN7|Patchwork|FIN6|Lazarus Group|Putter Panda|APT29|Darkhotel
-T1059,Command-Line Interface,Execution,APT41|Soft Cell|Turla|Silence|APT32|Cobalt Group|MuddyWater|APT18|APT38|Dragonfly 2.0|Gorgon Group|APT28|FIN7|Rancor|Honeybee|Leviathan|APT37|FIN8|Magic Hound|Sowbug|OilRig|BRONZE BUTLER|menuPass|Threat Group-3390|Suckfly|Patchwork|Lazarus Group|Threat Group-1314|APT3|admin@338|APT1|Ke3chang
+T1060,Registry Run Keys / Startup Folder,Persistence,APT41|Machete|Kimsuky|APT33|APT39|APT32|APT18|Turla|APT19|Dark Caracal|Ke3chang|Dragonfly 2.0|Cobalt Group|Honeybee|Threat Group-3390|Gorgon Group|MuddyWater|APT37|Leviathan|BRONZE BUTLER|APT3|Magic Hound|FIN10|FIN7|Patchwork|FIN6|Lazarus Group|Putter Panda|APT29|Darkhotel
+T1059,Command-Line Interface,Execution,APT41|Soft Cell|Turla|Silence|APT32|Cobalt Group|MuddyWater|APT18|APT38|Dragonfly 2.0|Gorgon Group|APT28|FIN7|Rancor|Honeybee|APT37|Leviathan|FIN8|Magic Hound|Sowbug|OilRig|BRONZE BUTLER|menuPass|Threat Group-3390|Suckfly|Patchwork|Lazarus Group|Threat Group-1314|APT3|admin@338|APT1|Ke3chang
 T1058,Service Registry Permissions Weakness,Persistence|Privilege Escalation,no
 T1057,Process Discovery,Discovery,Darkhotel|MuddyWater|APT1|APT38|Tropic Trooper|APT37|Honeybee|OilRig|APT3|Magic Hound|APT28|Winnti Group|Stealth Falcon|Poseidon Group|Lazarus Group|Molerats|Turla|Deep Panda|Ke3chang
 T1056,Input Capture,Collection|Credential Access,APT41|Kimsuky|menuPass|Stolen Pencil|FIN4|APT38|OilRig|Ke3chang|PLATINUM|Sowbug|Magic Hound|Group5|Lazarus Group|Threat Group-3390|APT3|Darkhotel|APT28
@@ -238,18 +238,18 @@ T1031,Modify Existing Service,Persistence,APT41|APT32|Honeybee|APT19
 T1030,Data Transfer Size Limits,Exfiltration,Threat Group-3390
 T1029,Scheduled Transfer,Exfiltration,no
 T1028,Windows Remote Management,Execution|Lateral Movement,Threat Group-3390
-T1027,Obfuscated Files or Information,Defense Evasion,Machete|Soft Cell|Turla|TA505|Silence|APT33|Night Dragon|Darkhotel|Gallmaker|APT29|APT18|Tropic Trooper|menuPass|Patchwork|Leafminer|Cobalt Group|APT37|Threat Group-3390|APT19|Honeybee|Dark Caracal|FIN8|BlackOasis|Elderwood|Leviathan|MuddyWater|FIN7|APT3|Magic Hound|OilRig|APT32|Group5|Dust Storm|Lazarus Group|Putter Panda|APT28
+T1027,Obfuscated Files or Information,Defense Evasion,Machete|Soft Cell|Turla|TA505|Silence|APT33|Night Dragon|Darkhotel|Gallmaker|APT29|APT18|Tropic Trooper|menuPass|Patchwork|Leafminer|Cobalt Group|APT37|Threat Group-3390|Honeybee|Dark Caracal|APT19|FIN8|BlackOasis|Elderwood|Leviathan|MuddyWater|FIN7|Magic Hound|APT3|OilRig|APT32|Group5|Dust Storm|Lazarus Group|Putter Panda|APT28
 T1026,Multiband Communication,Command And Control,Lazarus Group
 T1025,Data from Removable Media,Collection,Machete|Turla|Gamaredon Group|APT28
 T1024,Custom Cryptographic Protocol,Command And Control,APT28|BRONZE BUTLER|Lazarus Group
-T1023,Shortcut Modification,Persistence,APT39|Darkhotel|APT29|Gorgon Group|FIN7|Dragonfly 2.0|Leviathan|Lazarus Group
-T1022,Data Encrypted,Exfiltration,Kimsuky|Soft Cell|Turla|menuPass|APT32|Patchwork|Honeybee|BRONZE BUTLER|CopyKittens|FIN6|Lazarus Group|Threat Group-3390|Ke3chang
+T1023,Shortcut Modification,Persistence,APT39|Darkhotel|APT29|FIN7|Gorgon Group|Dragonfly 2.0|Leviathan|Lazarus Group
+T1022,Data Encrypted,Exfiltration,Kimsuky|Soft Cell|Turla|menuPass|APT32|Patchwork|Honeybee|CopyKittens|BRONZE BUTLER|FIN6|Lazarus Group|Threat Group-3390|Ke3chang
 T1021,Remote Services,Lateral Movement,TEMP.Veles|Leviathan|APT39|OilRig|menuPass|GCMAN
 T1020,Automated Exfiltration,Exfiltration,Honeybee
 T1019,System Firmware,Persistence,no
-T1018,Remote System Discovery,Discovery,Soft Cell|APT32|Threat Group-3390|Dragonfly 2.0|Deep Panda|Ke3chang|Leafminer|FIN8|FIN5|APT3|BRONZE BUTLER|menuPass|FIN6|Turla
+T1018,Remote System Discovery,Discovery,Soft Cell|APT32|Threat Group-3390|Dragonfly 2.0|Deep Panda|Ke3chang|Leafminer|FIN8|APT3|FIN5|BRONZE BUTLER|menuPass|FIN6|Turla
 T1017,Application Deployment Software,Lateral Movement,APT32
-T1016,System Network Configuration Discovery,Discovery,APT41|Soft Cell|APT39|APT32|Darkhotel|MuddyWater|APT1|APT19|Dragonfly 2.0|Magic Hound|OilRig|menuPass|Threat Group-3390|Stealth Falcon|Lazarus Group|APT3|Naikon|admin@338|Turla|Ke3chang
+T1016,System Network Configuration Discovery,Discovery,APT41|Soft Cell|APT39|APT32|Darkhotel|MuddyWater|APT1|APT19|Dragonfly 2.0|OilRig|Magic Hound|menuPass|Threat Group-3390|Stealth Falcon|Lazarus Group|APT3|Naikon|admin@338|Turla|Ke3chang
 T1015,Accessibility Features,Persistence|Privilege Escalation,APT41|APT3|APT29|Deep Panda|Axiom
 T1014,Rootkit,Defense Evasion,APT41|APT28|Winnti Group
 T1013,Port Monitors,Persistence|Privilege Escalation,no
@@ -262,6 +262,6 @@ T1007,System Service Discovery,Discovery,APT1|OilRig|Poseidon Group|admin@338|Tu
 T1006,File System Logical Offsets,Defense Evasion,no
 T1005,Data from Local System,Collection,Kimsuky|Soft Cell|Turla|menuPass|Dragonfly 2.0|Dark Caracal|Honeybee|APT37|APT28|APT3|BRONZE BUTLER|Patchwork|Stealth Falcon|Lazarus Group|Dust Storm|Threat Group-3390|APT1|Ke3chang
 T1004,Winlogon Helper DLL,Persistence,Tropic Trooper|Turla
-T1003,Credential Dumping,Credential Access,APT41|Soft Cell|TEMP.Veles|APT33|Leviathan|APT39|Stolen Pencil|APT32|Night Dragon|Dragonfly 2.0|Leafminer|Lazarus Group|Magic Hound|APT37|MuddyWater|PLATINUM|FIN8|Sowbug|BRONZE BUTLER|FIN5|OilRig|menuPass|Strider|Patchwork|Suckfly|Stealth Falcon|FIN6|Poseidon Group|Threat Group-3390|APT3|Molerats|APT28|APT1|Ke3chang|Cleaver|Axiom
+T1003,Credential Dumping,Credential Access,APT41|Soft Cell|TEMP.Veles|APT33|Leviathan|APT39|Stolen Pencil|APT32|Night Dragon|Dragonfly 2.0|Leafminer|Lazarus Group|Magic Hound|APT37|MuddyWater|PLATINUM|FIN8|Sowbug|BRONZE BUTLER|FIN5|OilRig|menuPass|Strider|Patchwork|Stealth Falcon|Suckfly|FIN6|Poseidon Group|Threat Group-3390|APT3|Molerats|APT28|APT1|Ke3chang|Cleaver|Axiom
 T1002,Data Compressed,Exfiltration,APT41|Soft Cell|Gallmaker|APT33|APT32|APT39|MuddyWater|Honeybee|Magic Hound|APT28|Dragonfly 2.0|FIN8|BRONZE BUTLER|CopyKittens|Sowbug|APT3|menuPass|FIN6|Lazarus Group|Threat Group-3390|APT1|Ke3chang
 T1001,Data Obfuscation,Command And Control,APT28|Axiom
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security-content
-# On Date: 2020-05-25T08:45:24 UTC
+# On Date: 2020-05-25T14:45:46 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -16,7 +16,7 @@ version = 1
 reference = ["https://aws.amazon.com/blogs/security/aws-cloudtrail-now-tracks-cross-account-activity-to-its-origin/"]
 detection_searches = ["ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule"]
 mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.AE"]}
-investigative_searches = ["ESCU - AWS Investigate User Activities By AccessKeyId", "ESCU - AWS Investigate User Activities By Source User", "ESCU - Get Notable History"]
+investigative_searches = ["ESCU - AWS Investigate User Activities By Source User", "ESCU - Get Notable History", "ESCU - AWS Investigate User Activities By AccessKeyId"]
 support_searches = ["ESCU - Previously Seen AWS Cross Account Activity"]
 data_models = []
 providing_technologies = none
@@ -34,8 +34,8 @@ version = 1
 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
 detection_searches = ["ESCU - Abnormally High AWS Instances Launched by User - Rule", "ESCU - EC2 Instance Started In Previously Unseen Region - Rule", "ESCU - EC2 Instance Started With Previously Unseen AMI - Rule", "ESCU - EC2 Instance Started With Previously Unseen Instance Type - Rule", "ESCU - EC2 Instance Started With Previously Unseen User - Rule"]
 mappings = {"cis20": ["CIS 1", "CIS 12", "CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.AE", "DE.DP", "ID.AM"]}
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table", "ESCU - AWS Investigate User Activities By ARN", "ESCU - Get EC2 Instance Details by instanceId", "ESCU - Investigate AWS activities via region name", "ESCU - Get Notable History", "ESCU - Get EC2 Launch Details"]
-support_searches = ["ESCU - Previously Seen EC2 Instance Types", "ESCU - Previously Seen EC2 Launches By User", "ESCU - Previously Seen EC2 AMIs", "ESCU - Previously Seen AWS Regions"]
+investigative_searches = ["ESCU - Get User Information from Identity Table", "ESCU - AWS Investigate User Activities By ARN", "ESCU - Investigate AWS activities via region name", "ESCU - Get Notable History", "ESCU - Get EC2 Instance Details by instanceId", "ESCU - Get Notable Info", "ESCU - Get EC2 Launch Details"]
+support_searches = ["ESCU - Previously Seen EC2 Launches By User", "ESCU - Previously Seen AWS Regions", "ESCU - Previously Seen EC2 Instance Types", "ESCU - Previously Seen EC2 AMIs"]
 data_models = []
 providing_technologies = none
 description = Monitor your AWS EC2 instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or EC2 instances started by previously unseen users are just a few examples of potentially malicious behavior.
@@ -53,7 +53,7 @@ version = 2
 reference = ["https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Appendix_NACLs.html", "https://aws.amazon.com/blogs/security/how-to-help-prepare-for-ddos-attacks-by-reducing-your-attack-surface/"]
 detection_searches = ["ESCU - AWS Network Access Control List Created with All Open Ports - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - Detect Spike in Network ACL Activity - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule"]
 mappings = {"cis20": ["CIS 11", "CIS 12"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "nist": ["DE.AE", "DE.CM", "DE.DP", "PR.AC"]}
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table", "ESCU - AWS Investigate User Activities By ARN", "ESCU - Get All AWS Activity From IP Address", "ESCU - Get DNS traffic ratio", "ESCU - AWS Network ACL Details from ID", "ESCU - Get Process Information For Port Activity", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Process Responsible For The DNS Traffic", "ESCU - Get Risk Modifiers For User", "ESCU - AWS Network Interface details via resourceId", "ESCU - Get DNS Server History for a host", "ESCU - Get Process Info", "ESCU - Get Notable History"]
+investigative_searches = ["ESCU - AWS Network ACL Details from ID", "ESCU - Get DNS Server History for a host", "ESCU - AWS Investigate User Activities By ARN", "ESCU - Get Process Responsible For The DNS Traffic", "ESCU - Get Notable History", "ESCU - Get Process Info", "ESCU - Get All AWS Activity From IP Address", "ESCU - Get DNS traffic ratio", "ESCU - Get Process Information For Port Activity", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - AWS Network Interface details via resourceId", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table"]
 support_searches = ["ESCU - Baseline of blocked outbound traffic from AWS", "ESCU - Baseline of Network ACL Activity by ARN"]
 data_models = []
 providing_technologies = none
@@ -69,7 +69,7 @@ version = 1
 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
 detection_searches = ["ESCU - AWS Cloud Provisioning From Previously Unseen City - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen Country - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen IP Address - Rule", "ESCU - AWS Cloud Provisioning From Previously Unseen Region - Rule"]
 mappings = {"cis20": ["CIS 1"], "nist": ["ID.AM"]}
-investigative_searches = ["ESCU - Get All AWS Activity From IP Address", "ESCU - Get All AWS Activity From Country", "ESCU - Get All AWS Activity From City", "ESCU - Get All AWS Activity From Region"]
+investigative_searches = ["ESCU - Get All AWS Activity From IP Address", "ESCU - Get All AWS Activity From Region", "ESCU - Get All AWS Activity From Country", "ESCU - Get All AWS Activity From City"]
 support_searches = ["ESCU - Previously Seen AWS Provisioning Activity Sources"]
 data_models = []
 providing_technologies = none
@@ -86,8 +86,8 @@ version = 1
 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://redlock.io/blog/cryptojacking-tesla"]
 detection_searches = ["ESCU - Detect API activity from users without MFA - Rule", "ESCU - Detect AWS API Activities From Unapproved Accounts - Rule", "ESCU - Detect Spike in AWS API Activity - Rule", "ESCU - Detect Spike in Security Group Activity - Rule", "ESCU - Detect new API calls from user roles - Rule"]
 mappings = {"cis20": ["CIS 1", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.CM", "DE.DP", "ID.AM", "PR.AC"]}
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Investigate AWS User Activities by user field", "ESCU - Get Notable History"]
-support_searches = ["ESCU - Create a list of approved AWS service accounts", "ESCU - Baseline of Security Group Activity by ARN", "ESCU - Previously seen API call per user roles in CloudTrail", "ESCU - Baseline of API Calls per User ARN"]
+investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Investigate AWS User Activities by user field"]
+support_searches = ["ESCU - Baseline of API Calls per User ARN", "ESCU - Baseline of Security Group Activity by ARN", "ESCU - Previously seen API call per user roles in CloudTrail", "ESCU - Create a list of approved AWS service accounts"]
 data_models = []
 providing_technologies = none
 description = Detect and investigate dormant user accounts for your AWS environment that have become active again. Because inactive and ad-hoc accounts are common attack targets, it's critical to enable governance within your environment.
@@ -102,10 +102,10 @@ creation_date = 2017-09-06
 modification_date = 2017-09-06
 id = 8892a655-6205-55f7-abba-06460e38c8ae
 version = 1
-reference = ["https://www.sans.org/media/critical-security-controls/critical-controls-poster-2016.pdf"]
+reference = []
 detection_searches = ["ESCU - Detect Excessive Account Lockouts From Endpoint - Rule", "ESCU - Detect Excessive User Account Lockouts - Rule", "ESCU - Identify New User Accounts - Rule", "ESCU - Short Lived Windows Accounts - Rule"]
 mappings = {"cis20": ["CIS 16"], "mitre_attack": ["T1078", "T1136"], "nist": ["PR.IP"]}
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table", "ESCU - Get Logon Rights Modifications For Endpoint", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Logon Rights Modifications For User", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Notable History"]
+investigative_searches = ["ESCU - Get Logon Rights Modifications For Endpoint", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For User", "ESCU - Get Logon Rights Modifications For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table"]
 support_searches = []
 data_models = ["Change"]
 providing_technologies = none
@@ -121,7 +121,7 @@ version = 1
 reference = ["https://github.com/SpiderLabs/owasp-modsecurity-crs/blob/v3.2/dev/rules/REQUEST-944-APPLICATION-ATTACK-JAVA.conf"]
 detection_searches = ["ESCU - Suspicious Java Classes - Rule", "ESCU - Unusually Long Content-Type Length - Rule", "ESCU - Web Servers Executing Suspicious Processes - Rule"]
 mappings = {"cis20": ["CIS 12", "CIS 18", "CIS 3", "CIS 4"], "kill_chain_phases": ["Actions on Objectives", "Delivery", "Exploitation"], "mitre_attack": ["T1082"], "nist": ["DE.AE", "DE.CM", "ID.RA", "PR.IP", "PR.MA", "PR.PT", "RS.MI"]}
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table", "ESCU - Investigate Web POSTs From src", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Investigate Suspicious Strings in HTTP Header", "ESCU - Get Notable History"]
+investigative_searches = ["ESCU - Get Notable History", "ESCU - Get Risk Modifiers For User", "ESCU - Investigate Suspicious Strings in HTTP Header", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Investigate Web POSTs From src", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table"]
 support_searches = []
 data_models = ["Endpoint"]
 providing_technologies = none
@@ -150,7 +150,7 @@ version = 1
 reference = ["https://www.cisecurity.org/controls/inventory-of-authorized-and-unauthorized-devices/"]
 detection_searches = ["ESCU - Detect Unauthorized Assets by MAC address - Rule"]
 mappings = {"cis20": ["CIS 1"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.DS"]}
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get First Occurrence and Last Occurrence of a MAC Address", "ESCU - Get Notable History"]
+investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get First Occurrence and Last Occurrence of a MAC Address"]
 support_searches = ["ESCU - Count of assets by category"]
 data_models = ["Network_Sessions"]
 providing_technologies = none
@@ -166,7 +166,7 @@ version = 1
 reference = ["https://www.zerofox.com/blog/what-is-digital-risk-monitoring/", "https://securingtomorrow.mcafee.com/consumer/family-safety/what-is-typosquatting/", "https://blog.malwarebytes.com/cybercrime/2016/06/explained-typosquatting/"]
 detection_searches = ["ESCU - Monitor DNS For Brand Abuse - Rule", "ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Monitor Web Traffic For Brand Abuse - Rule"]
 mappings = {"cis20": ["CIS 7"], "kill_chain_phases": ["Actions on Objectives", "Delivery"], "nist": ["PR.IP"]}
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table", "ESCU - Get Emails From Specific Sender", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Process Responsible For The DNS Traffic", "ESCU - Get Risk Modifiers For User", "ESCU - Get Email Info", "ESCU - Investigate Web Activity From Host", "ESCU - Get Notable History"]
+investigative_searches = ["ESCU - Get Process Responsible For The DNS Traffic", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For User", "ESCU - Investigate Web Activity From Host", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Emails From Specific Sender", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Email Info", "ESCU - Get User Information from Identity Table"]
 support_searches = ["ESCU - DNSTwist Domain Names"]
 data_models = ["Email", "Network_Resolution", "Web"]
 providing_technologies = none
@@ -184,8 +184,8 @@ version = 1
 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
 detection_searches = ["ESCU - Abnormally High AWS Instances Launched by User - MLTK - Rule", "ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule", "ESCU - Cloud Compute Instance Started In Previously Unused Region - Rule"]
 mappings = {"cis20": ["CIS 1", "CIS 12", "CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.AE", "DE.DP", "ID.AM"]}
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table", "ESCU - Investigate User Activities In All Cloud Regions", "ESCU - AWS Investigate User Activities By ARN", "ESCU - Get EC2 Instance Details by instanceId", "ESCU - Investigate AWS activities via region name", "ESCU - Investigate User Activities In Single Cloud Region", "ESCU - Investigate Cloud Compute Instance Activities", "ESCU - Get Notable History", "ESCU - Get EC2 Launch Details"]
-support_searches = ["ESCU - Previously Seen Cloud Compute Creations By User", "ESCU - Baseline of Excessive AWS Instances Launched by User - MLTK", "ESCU - Previously Seen Cloud Compute Images", "ESCU - Previously Seen Cloud Compute Instance Types", "ESCU - Previously Seen Cloud Regions"]
+investigative_searches = ["ESCU - Get User Information from Identity Table", "ESCU - AWS Investigate User Activities By ARN", "ESCU - Investigate AWS activities via region name", "ESCU - Investigate User Activities In Single Cloud Region", "ESCU - Get Notable History", "ESCU - Investigate User Activities In All Cloud Regions", "ESCU - Get EC2 Instance Details by instanceId", "ESCU - Investigate Cloud Compute Instance Activities", "ESCU - Get Notable Info", "ESCU - Get EC2 Launch Details"]
+support_searches = ["ESCU - Previously Seen Cloud Compute Images", "ESCU - Previously Seen Cloud Regions", "ESCU - Previously Seen Cloud Compute Creations By User", "ESCU - Baseline of Excessive AWS Instances Launched by User - MLTK", "ESCU - Previously Seen Cloud Compute Instance Types"]
 data_models = ["Cloud_Infrastructure"]
 providing_technologies = none
 description = Monitor your cloud compute instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or compute instances started by previously unseen users are just a few examples of potentially malicious behavior.
@@ -203,7 +203,7 @@ version = 1
 reference = ["https://www.intego.com/mac-security-blog/osxcoldroot-and-the-rat-invasion/", "https://objective-see.com/blog/blog_0x2A.html", "https://www.bleepingcomputer.com/news/security/coldroot-rat-still-undetectable-despite-being-uploaded-on-github-two-years-ago/"]
 detection_searches = ["ESCU - Osquery pack - ColdRoot detection - Rule", "ESCU - Processes Tapping Keyboard Events - Rule"]
 mappings = {"cis20": ["CIS 4", "CIS 8"], "kill_chain_phases": ["Command and Control"], "nist": ["DE.DP", "PR.PT"]}
-investigative_searches = ["ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Investigate Web Activity From src ip", "ESCU - Investigate Network Traffic From src ip", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Notable History"]
+investigative_searches = ["ESCU - Investigate Network Traffic From src ip", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Investigate Web Activity From src ip", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table"]
 support_searches = []
 data_models = []
 providing_technologies = none
@@ -221,7 +221,7 @@ version = 1
 reference = ["https://attack.mitre.org/wiki/Collection", "https://attack.mitre.org/wiki/Technique/T1074"]
 detection_searches = ["ESCU - Email files written outside of the Outlook directory - Rule", "ESCU - Email servers sending high volume traffic to hosts - Rule", "ESCU - Hosts receiving high volume of network traffic from email server - Rule", "ESCU - Suspicious writes to System Volume Information - Rule", "ESCU - Suspicious writes to windows Recycle Bin - Rule"]
 mappings = {"cis20": ["CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1043", "T1074", "T1114"], "nist": ["DE.AE", "DE.CM", "PR.PT"]}
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Notable History"]
+investigative_searches = ["ESCU - Get Parent Process Info", "ESCU - Get Notable History", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table"]
 support_searches = []
 data_models = ["Endpoint", "Network_Traffic"]
 providing_technologies = none
@@ -239,8 +239,8 @@ version = 1
 reference = ["https://attack.mitre.org/wiki/Command_and_Control", "https://searchsecurity.techtarget.com/feature/Command-and-control-servers-The-puppet-masters-that-govern-malware"]
 detection_searches = ["ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Detect Large Outbound ICMP Packets - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - TOR Traffic - Rule"]
 mappings = {"cis20": ["CIS 1", "CIS 11", "CIS 12", "CIS 13", "CIS 3", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery"], "mitre_attack": ["T1043", "T1048", "T1095"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.AC", "PR.DS", "PR.IP", "PR.PT"]}
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table", "ESCU - AWS Investigate User Activities By ARN", "ESCU - Get All AWS Activity From IP Address", "ESCU - Get DNS traffic ratio", "ESCU - AWS Network ACL Details from ID", "ESCU - Get Process Information For Port Activity", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Process Responsible For The DNS Traffic", "ESCU - Get Risk Modifiers For User", "ESCU - AWS Network Interface details via resourceId", "ESCU - Get Parent Process Info", "ESCU - Get DNS Server History for a host", "ESCU - Get Process Info", "ESCU - Get Notable History"]
-support_searches = ["ESCU - Baseline of DNS Query Length - MLTK", "ESCU - Baseline of blocked outbound traffic from AWS"]
+investigative_searches = ["ESCU - AWS Network ACL Details from ID", "ESCU - Get DNS Server History for a host", "ESCU - AWS Investigate User Activities By ARN", "ESCU - Get Process Responsible For The DNS Traffic", "ESCU - Get Parent Process Info", "ESCU - Get Notable History", "ESCU - Get Process Info", "ESCU - Get All AWS Activity From IP Address", "ESCU - Get DNS traffic ratio", "ESCU - Get Process Information For Port Activity", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - AWS Network Interface details via resourceId", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table"]
+support_searches = ["ESCU - Baseline of blocked outbound traffic from AWS", "ESCU - Baseline of DNS Query Length - MLTK"]
 data_models = ["Network_Resolution", "Network_Traffic"]
 providing_technologies = none
 description = Detect and investigate tactics, techniques, and procedures leveraged by attackers to establish and operate command and control channels. Implants installed by attackers on compromised endpoints use these channels to receive instructions and send data back to the malicious operators.
@@ -289,7 +289,7 @@ version = 3
 reference = ["https://attack.mitre.org/wiki/Technique/T1003", "https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html"]
 detection_searches = ["ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Attempt To Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule"]
 mappings = {"cis20": ["CIS 16", "CIS 3", "CIS 5", "CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Installation"], "mitre_attack": ["T1003", "T1064", "T1086"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.IP"]}
-investigative_searches = ["ESCU - Investigate Previous Unseen User", "ESCU - Investigate Failed Logins for Multiple Destinations", "ESCU - Investigate Pass the Ticket Attempts", "ESCU - Investigate Pass the Hash Attempts"]
+investigative_searches = ["ESCU - Investigate Failed Logins for Multiple Destinations", "ESCU - Investigate Previous Unseen User", "ESCU - Investigate Pass the Hash Attempts", "ESCU - Investigate Pass the Ticket Attempts"]
 support_searches = []
 data_models = ["Endpoint"]
 providing_technologies = none
@@ -307,8 +307,8 @@ version = 2
 reference = ["https://www.us-cert.gov/ncas/alerts/TA18-074A"]
 detection_searches = ["ESCU - Create local admin accounts using net exe - Rule", "ESCU - Detect New Local Admin account - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Scheduled Task Name Used by Dragonfly Threat Actors - Rule", "ESCU - Single Letter Process On Endpoint - Rule", "ESCU - Suspicious Reg exe Process - Rule"]
 mappings = {"cis20": ["CIS 12", "CIS 16", "CIS 2", "CIS 3", "CIS 5", "CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Installation"], "mitre_attack": ["T1031", "T1043", "T1050", "T1053", "T1059", "T1064", "T1078", "T1086", "T1089", "T1103", "T1112", "T1131"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.AC", "PR.AT", "PR.DS", "PR.IP", "PR.PT"]}
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table", "ESCU - Get Process Information For Port Activity", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Registry Activities", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Parent Process Info", "ESCU - Get Process File Activity", "ESCU - Get Process Registry Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Get Process Info", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Notable History"]
-support_searches = ["ESCU - Previously seen command line arguments", "ESCU - Baseline of SMB Traffic - MLTK"]
+investigative_searches = ["ESCU - Get Parent Process Info", "ESCU - Get Notable History", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get Process Information For Port Activity", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Investigate Web Activity From Host", "ESCU - Get Process Registry Activity", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Process File Activity", "ESCU - Get User Information from Identity Table", "ESCU - Get Registry Activities"]
+support_searches = ["ESCU - Baseline of SMB Traffic - MLTK", "ESCU - Previously seen command line arguments"]
 data_models = ["Endpoint", "Network_Traffic"]
 providing_technologies = none
 description = Monitor for suspicious activities associated with DHS Technical Alert US-CERT TA18-074A. Some of the activities that adversaries used in these compromises included spearfishing attacks, malware, watering-hole domains, many and more.
@@ -326,7 +326,7 @@ version = 1
 reference = ["https://www.us-cert.gov/ncas/alerts/TA13-088A", "https://www.imperva.com/learn/application-security/dns-amplification/"]
 detection_searches = ["ESCU - Large Volume of DNS ANY Queries - Rule"]
 mappings = {"cis20": ["CIS 12"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.IP"]}
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For Endpoint"]
+investigative_searches = ["ESCU - Get Risk Modifiers For User", "ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For Endpoint"]
 support_searches = []
 data_models = ["Network_Resolution"]
 providing_technologies = none
@@ -367,7 +367,7 @@ version = 1
 reference = ["https://www.cisecurity.org/controls/data-protection/", "https://www.sans.org/reading-room/whitepapers/dns/splunk-detect-dns-tunneling-37022", "https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/"]
 detection_searches = ["ESCU - Detect USB device insertion - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule"]
 mappings = {"cis20": ["CIS 12", "CIS 13", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1043"], "nist": ["DE.AE", "DE.CM", "PR.DS", "PR.PT"]}
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table", "ESCU - Get DNS traffic ratio", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Process Responsible For The DNS Traffic", "ESCU - Get Risk Modifiers For User", "ESCU - Get DNS Server History for a host", "ESCU - Get Process Info", "ESCU - Get Notable History"]
+investigative_searches = ["ESCU - Get DNS Server History for a host", "ESCU - Get Process Responsible For The DNS Traffic", "ESCU - Get Notable History", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get DNS traffic ratio", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table"]
 support_searches = []
 data_models = ["Change_Analysis", "Network_Resolution"]
 providing_technologies = none
@@ -383,8 +383,8 @@ version = 2
 reference = ["https://attack.mitre.org/wiki/Technique/T1089", "https://blog.malwarebytes.com/cybercrime/2015/11/vonteera-adware-uses-certificates-to-disable-anti-malware/", "https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Tools-Report.pdf"]
 detection_searches = ["ESCU - Attempt To Add Certificate To Untrusted Store - Rule", "ESCU - Attempt To Stop Security Service - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Unload Sysmon Filter Driver - Rule"]
 mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Installation"], "mitre_attack": ["T1031", "T1050", "T1059", "T1089", "T1112"], "nist": ["DE.CM", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]}
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Parent Process Info", "ESCU - Investigate Web Activity From Host", "ESCU - Get Process Info", "ESCU - Get Notable History"]
-support_searches = ["ESCU - Previously seen command line arguments", "ESCU - Baseline of SMB Traffic - MLTK"]
+investigative_searches = ["ESCU - Get Parent Process Info", "ESCU - Get Notable History", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Investigate Web Activity From Host", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table"]
+support_searches = ["ESCU - Baseline of SMB Traffic - MLTK", "ESCU - Previously seen command line arguments"]
 data_models = ["Endpoint"]
 providing_technologies = none
 description = Looks for activities and techniques associated with the disabling of security tools on a Windows system, such as suspicious `reg.exe` processes, processes launching netsh, and many others.
@@ -399,7 +399,7 @@ version = 2
 reference = ["https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html", "https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/", "http://www.noip.com/blog/2014/07/11/dynamic-dns-can-use-2/", "https://www.splunk.com/blog/2015/08/04/detecting-dynamic-dns-domains-in-splunk.html"]
 detection_searches = ["ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detect web traffic to dynamic domain providers - Rule"]
 mappings = {"cis20": ["CIS 13", "CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1041"], "nist": ["DE.CM", "DE.DP", "PR.IP"]}
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table", "ESCU - Get DNS traffic ratio", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Process Responsible For The DNS Traffic", "ESCU - Get Risk Modifiers For User", "ESCU - Investigate Web Activity From src ip", "ESCU - Get DNS Server History for a host", "ESCU - Get Notable History"]
+investigative_searches = ["ESCU - Get DNS Server History for a host", "ESCU - Get Process Responsible For The DNS Traffic", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For User", "ESCU - Get DNS traffic ratio", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Investigate Web Activity From src ip", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table"]
 support_searches = []
 data_models = ["Network_Resolution", "Web"]
 providing_technologies = none
@@ -415,8 +415,8 @@ version = 1
 reference = ["https://www.us-cert.gov/ncas/alerts/TA18-201A", "https://www.first.org/resources/papers/conf2017/Advanced-Incident-Detection-and-Threat-Hunting-using-Sysmon-and-Splunk.pdf", "https://www.vkremez.com/2017/05/emotet-banking-trojan-malware-analysis.html"]
 detection_searches = ["ESCU - Detect Rare Executables - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - Detection of tools built by NirSoft - Rule", "ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule"]
 mappings = {"cis20": ["CIS 12", "CIS 2", "CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery", "Exploitation", "Installation"], "mitre_attack": ["T1043", "T1059", "T1072", "T1087", "T1103", "T1131"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.DS", "PR.IP", "PR.PT"]}
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table", "ESCU - Get Process Information For Port Activity", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Registry Activities", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Parent Process Info", "ESCU - Investigate Web Activity From Host", "ESCU - Get Process Info", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Notable History"]
-support_searches = ["ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Baseline of SMB Traffic - MLTK"]
+investigative_searches = ["ESCU - Get Parent Process Info", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Registry Activities"]
+support_searches = ["ESCU - Baseline of SMB Traffic - MLTK", "ESCU - Add Prohibited Processes to Enterprise Security"]
 data_models = ["Email", "Endpoint", "Network_Traffic"]
 providing_technologies = none
 description = Detect rarely used executables, specific registry paths that may confer malware survivability and persistence, instances where cmd.exe is used to launch script interpreters, and other indicators that the Emotet financial malware has compromised your environment.
@@ -433,8 +433,8 @@ version = 2
 reference = ["https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity", "https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf"]
 detection_searches = ["ESCU - Create or delete windows shares using net exe - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Suspicious File Write - Rule"]
 mappings = {"cis20": ["CIS 12", "CIS 16", "CIS 3", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1043", "T1059", "T1064", "T1076"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.IP", "PR.PT"]}
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table", "ESCU - Get DNS traffic ratio", "ESCU - Get Process Information For Port Activity", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Process Responsible For The DNS Traffic", "ESCU - Get Risk Modifiers For User", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Get Parent Process Info", "ESCU - Investigate Web Activity From Host", "ESCU - Get DNS Server History for a host", "ESCU - Get Process Info", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Notable History"]
-support_searches = ["ESCU - Previously seen command line arguments", "ESCU - Baseline of DNS Query Length - MLTK", "ESCU - Baseline of SMB Traffic - MLTK"]
+investigative_searches = ["ESCU - Get DNS Server History for a host", "ESCU - Get Process Responsible For The DNS Traffic", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Get Parent Process Info", "ESCU - Get Notable History", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get DNS traffic ratio", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table"]
+support_searches = ["ESCU - Baseline of SMB Traffic - MLTK", "ESCU - Baseline of DNS Query Length - MLTK", "ESCU - Previously seen command line arguments"]
 data_models = ["Endpoint", "Network_Resolution", "Network_Traffic"]
 providing_technologies = none
 description = Monitor for and investigate activities, including the creation or deletion of hidden shares and file writes, that may be evidence of infiltration by North Korean government-sponsored cybercriminals. Details of this activity were reported in DHS Report TA-18-149A.
@@ -452,7 +452,7 @@ version = 1
 reference = ["https://blog.malwarebytes.com/cybercrime/2016/09/hosts-file-hijacks/"]
 detection_searches = ["ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Windows hosts file modification - Rule"]
 mappings = {"cis20": ["CIS 1", "CIS 12", "CIS 13", "CIS 3", "CIS 8"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1048"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.AC", "PR.DS", "PR.IP", "PR.PT"]}
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get DNS Server History for a host", "ESCU - Get Notable History"]
+investigative_searches = ["ESCU - Get DNS Server History for a host", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table"]
 support_searches = []
 data_models = ["Network_Resolution"]
 providing_technologies = none
@@ -468,7 +468,7 @@ version = 1
 reference = ["http://www.deependresearch.org/2016/04/jboss-exploits-view-from-victim.html"]
 detection_searches = ["ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule", "ESCU - Detect malicious requests to exploit JBoss servers - Rule"]
 mappings = {"cis20": ["CIS 18"], "kill_chain_phases": ["Delivery", "Reconnaissance"], "mitre_attack": ["T1082"], "nist": ["DE.CM"]}
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Investigate Web Activity From Host", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Notable History"]
+investigative_searches = ["ESCU - Get Notable History", "ESCU - Investigate Web Activity From Host", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Notable Info"]
 support_searches = []
 data_models = ["Web"]
 providing_technologies = none
@@ -498,7 +498,7 @@ version = 1
 reference = ["https://github.com/splunk/cloud-datamodel-security-research"]
 detection_searches = ["ESCU - Amazon EKS Kubernetes Pod scan detection - Rule", "ESCU - Amazon EKS Kubernetes cluster scan detection - Rule", "ESCU - GCP Kubernetes cluster scan detection - Rule"]
 mappings = {"kill_chain_phases": ["Reconnaissance"]}
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - GCP Kubernetes activity by src ip", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Amazon EKS Kubernetes activity by src ip", "ESCU - Get Notable History"]
+investigative_searches = ["ESCU - GCP Kubernetes activity by src ip", "ESCU - Amazon EKS Kubernetes activity by src ip", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable Info"]
 support_searches = []
 data_models = []
 providing_technologies = none
@@ -514,7 +514,7 @@ version = 2
 reference = ["https://www.fireeye.com/blog/executive-perspective/2015/08/malware_lateral_move.html"]
 detection_searches = ["ESCU - Detect Activity Related to Pass the Hash Attacks - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - Schtasks scheduling job on remote system - Rule"]
 mappings = {"cis20": ["CIS 16", "CIS 3", "CIS 9"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1053", "T1075", "T1076"], "nist": ["DE.AE", "PR.AC", "PR.IP"]}
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table", "ESCU - Get Process Information For Port Activity", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Notable History"]
+investigative_searches = ["ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Get Parent Process Info", "ESCU - Get Notable History", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get Process Information For Port Activity", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table"]
 support_searches = []
 data_models = ["Endpoint", "Network_Traffic"]
 providing_technologies = none
@@ -534,7 +534,7 @@ version = 4
 reference = ["https://blogs.mcafee.com/mcafee-labs/malware-employs-powershell-to-infect-systems/", "https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"]
 detection_searches = ["ESCU - Attempt To Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments - Rule", "ESCU - Malicious PowerShell Process With Obfuscation Techniques - Rule"]
 mappings = {"cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1064", "T1086"], "nist": ["DE.CM", "PR.IP", "PR.PT"]}
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Notable History"]
+investigative_searches = ["ESCU - Get Parent Process Info", "ESCU - Get Notable History", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table"]
 support_searches = []
 data_models = ["Endpoint"]
 providing_technologies = none
@@ -559,7 +559,7 @@ version = 1
 reference = ["https://www.carbonblack.com/2016/03/04/tracking-locky-ransomware-using-carbon-black/"]
 detection_searches = ["ESCU - Extended Period Without Successful Netbackup Backups - Rule", "ESCU - Unsuccessful Netbackup backups - Rule"]
 mappings = {"cis20": ["CIS 10"], "nist": ["PR.IP"]}
-investigative_searches = ["ESCU - All backup logs for host", "ESCU - Get Risk Modifiers For User", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For Endpoint"]
+investigative_searches = ["ESCU - Get Risk Modifiers For User", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - All backup logs for host"]
 support_searches = ["ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups"]
 data_models = []
 providing_technologies = none
@@ -575,7 +575,7 @@ version = 1
 reference = ["https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"]
 detection_searches = ["ESCU - Prohibited Software On Endpoint - Rule"]
 mappings = {"cis20": ["CIS 2"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.DS"]}
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Parent Process Info", "ESCU - Investigate Web Activity From Host", "ESCU - Get Process Info", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Notable History"]
+investigative_searches = ["ESCU - Get Parent Process Info", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Investigate Web Activity From Host", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table"]
 support_searches = ["ESCU - Add Prohibited Processes to Enterprise Security"]
 data_models = ["Endpoint"]
 providing_technologies = none
@@ -610,8 +610,8 @@ version = 1
 reference = ["https://technet.microsoft.com/library/bb490939.aspx", "https://htmlpreview.github.io/?https://github.com/MatthewDemaske/blogbackup/blob/master/netshell.html", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html"]
 detection_searches = ["ESCU - Processes created by netsh - Rule", "ESCU - Processes launching netsh - Rule"]
 mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1059", "T1089"], "nist": ["DE.CM", "PR.PT"]}
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Parent Process Info", "ESCU - Investigate Web Activity From Host", "ESCU - Get Process Info", "ESCU - Get Notable History"]
-support_searches = ["ESCU - Previously seen command line arguments", "ESCU - Baseline of SMB Traffic - MLTK"]
+investigative_searches = ["ESCU - Get Parent Process Info", "ESCU - Get Notable History", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Investigate Web Activity From Host", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table"]
+support_searches = ["ESCU - Baseline of SMB Traffic - MLTK", "ESCU - Previously seen command line arguments"]
 data_models = ["Endpoint"]
 providing_technologies = none
 description = Detect activities and various techniques associated with the abuse of `netsh.exe`, which can disable local firewall settings or set up a remote connection to a host from an infected system.
@@ -627,8 +627,8 @@ version = 2
 reference = ["https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia", "https://www.infosecurity-magazine.com/news/healthcare-targeted-by-hacker/"]
 detection_searches = ["ESCU - First Time Seen Running Windows Service - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule"]
 mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Installation"], "mitre_attack": ["T1031", "T1050", "T1059", "T1064", "T1089"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]}
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Parent Process Info", "ESCU - Investigate Web Activity From Host", "ESCU - Get Process Info", "ESCU - Get Notable History"]
-support_searches = ["ESCU - Previously seen command line arguments", "ESCU - Previously Seen Running Windows Services"]
+investigative_searches = ["ESCU - Get Parent Process Info", "ESCU - Get Notable History", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Investigate Web Activity From Host", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table"]
+support_searches = ["ESCU - Previously Seen Running Windows Services", "ESCU - Previously seen command line arguments"]
 data_models = ["Endpoint"]
 providing_technologies = none
 description = Detect activities and various techniques associated with the Orangeworm Attack Group, a group that frequently targets the healthcare industry.
@@ -670,8 +670,8 @@ version = 1
 reference = ["https://www.infosecurity-magazine.com/news/scope-of-mudcarp-attacks-highlight-1/", "http://blog.amossys.fr/badflick-is-not-so-bad.html"]
 detection_searches = ["ESCU - First time seen command line argument - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule"]
 mappings = {"cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1059", "T1064", "T1086", "T1103", "T1131"], "nist": ["DE.AE", "DE.CM", "PR.IP", "PR.PT"]}
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Registry Activities", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Parent Process Info", "ESCU - Investigate Web Activity From Host", "ESCU - Get Process Info", "ESCU - Get Notable History"]
-support_searches = ["ESCU - Previously seen command line arguments", "ESCU - Baseline of Command Line Length - MLTK"]
+investigative_searches = ["ESCU - Get Parent Process Info", "ESCU - Get Notable History", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Investigate Web Activity From Host", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Registry Activities"]
+support_searches = ["ESCU - Baseline of Command Line Length - MLTK", "ESCU - Previously seen command line arguments"]
 data_models = ["Endpoint"]
 providing_technologies = none
 description = Monitor your environment for suspicious behaviors that resemble the techniques employed by the MUDCARP threat group.
@@ -713,7 +713,7 @@ version = 1
 reference = ["http://www.novetta.com/2015/02/advanced-methods-to-detect-advanced-cyber-attacks-protocol-abuse/"]
 detection_searches = ["ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - TOR Traffic - Rule"]
 mappings = {"cis20": ["CIS 12", "CIS 13", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery"], "mitre_attack": ["T1043", "T1048"], "nist": ["DE.AE", "DE.CM", "PR.AC"]}
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table", "ESCU - Get Process Information For Port Activity", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Parent Process Info", "ESCU - Get DNS Server History for a host", "ESCU - Get Process Info", "ESCU - Get Notable History"]
+investigative_searches = ["ESCU - Get DNS Server History for a host", "ESCU - Get Parent Process Info", "ESCU - Get Notable History", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get Process Information For Port Activity", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table"]
 support_searches = []
 data_models = ["Network_Resolution", "Network_Traffic"]
 providing_technologies = none
@@ -729,8 +729,8 @@ version = 1
 reference = ["https://www.carbonblack.com/2017/06/28/carbon-black-threat-research-technical-analysis-petya-notpetya-ransomware/", "https://www.splunk.com/blog/2017/06/27/closing-the-detection-to-mitigation-gap-or-to-petya-or-notpetya-whocares-.html"]
 detection_searches = ["ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - TOR Traffic - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Windows Event Log Cleared - Rule"]
 mappings = {"cis20": ["CIS 10", "CIS 12", "CIS 3", "CIS 5", "CIS 6", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery"], "mitre_attack": ["T1036", "T1043", "T1047", "T1048", "T1053", "T1070", "T1103", "T1131"], "nist": ["DE.AE", "DE.CM", "DE.DP", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]}
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table", "ESCU - Get Process Information For Port Activity", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Registry Activities", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Sysmon WMI Activity for Host", "ESCU - Get Parent Process Info", "ESCU - Investigate Web Activity From Host", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Process Info", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Notable History"]
-support_searches = ["ESCU - Baseline of SMB Traffic - MLTK", "ESCU - Baseline of Command Line Length - MLTK"]
+investigative_searches = ["ESCU - Get Sysmon WMI Activity for Host", "ESCU - Get Parent Process Info", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Registry Activities"]
+support_searches = ["ESCU - Baseline of Command Line Length - MLTK", "ESCU - Baseline of SMB Traffic - MLTK"]
 data_models = ["Endpoint", "Network_Traffic"]
 providing_technologies = none
 description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware--spikes in SMB traffic, suspicious wevtutil usage, the presence of common ransomware extensions, and system processes run from unexpected locations, and many others.
@@ -745,7 +745,7 @@ version = 1
 reference = ["https://www.fireeye.com/blog/executive-perspective/2015/09/the_new_route_toper.html", "https://www.cisco.com/c/en/us/about/security-center/event-response/synful-knock.html"]
 detection_searches = ["ESCU - Detect New Login Attempts to Routers - Rule"]
 mappings = {"cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.IP"]}
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History"]
+investigative_searches = ["ESCU - Get Notable History", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table"]
 support_searches = []
 data_models = ["Authentication"]
 providing_technologies = none
@@ -779,7 +779,7 @@ version = 1
 reference = ["https://www.crowdstrike.com/blog/an-in-depth-analysis-of-samsam-ransomware-and-boss-spider/", "https://nakedsecurity.sophos.com/2018/07/31/samsam-the-almost-6-million-ransomware/", "https://thehackernews.com/2018/07/samsam-ransomware-attacks.html"]
 detection_searches = ["ESCU - Batch File Write to System32 - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule", "ESCU - Detect malicious requests to exploit JBoss servers - Rule", "ESCU - File with Samsam Extension - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Samsam Test File Write - Rule", "ESCU - Spike in File Writes - Rule"]
 mappings = {"cis20": ["CIS 10", "CIS 12", "CIS 16", "CIS 18", "CIS 2", "CIS 3", "CIS 4", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery", "Installation", "Reconnaissance"], "mitre_attack": ["T1059", "T1076", "T1082"], "nist": ["DE.AE", "DE.CM", "ID.AM", "ID.RA", "PR.AC", "PR.DS", "PR.IP", "PR.MA", "PR.PT"]}
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table", "ESCU - Get Process Information For Port Activity", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Get Parent Process Info", "ESCU - Investigate Web Activity From Host", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Process Info", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Notable History"]
+investigative_searches = ["ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Get Parent Process Info", "ESCU - Get Update Logs For Endpoint", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get Process Information For Port Activity", "ESCU - Investigate Web Activity From Host", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table"]
 support_searches = ["ESCU - Add Prohibited Processes to Enterprise Security"]
 data_models = ["Endpoint", "Network_Traffic", "Web"]
 providing_technologies = none
@@ -800,7 +800,7 @@ version = 1
 reference = ["https://meltdownattack.com/"]
 detection_searches = ["ESCU - Spectre and Meltdown Vulnerable Systems - Rule"]
 mappings = {"cis20": ["CIS 4"], "nist": ["DE.CM"]}
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History"]
+investigative_searches = ["ESCU - Get Notable History", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table"]
 support_searches = ["ESCU - Systems Ready for Spectre-Meltdown Windows Patch"]
 data_models = ["Vulnerabilities"]
 providing_technologies = none
@@ -841,7 +841,7 @@ version = 1
 reference = ["https://nvd.nist.gov/vuln/detail/CVE-2018-11409", "https://www.splunk.com/view/SP-CAAAP5E#VulnerabilityDescriptionsandRatings", "https://www.exploit-db.com/exploits/44865/"]
 detection_searches = ["ESCU - Splunk Enterprise Information Disclosure - Rule"]
 mappings = {"cis20": ["CIS 18"], "kill_chain_phases": ["Delivery"], "nist": ["DE.CM"]}
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Investigate Web Activity From src ip", "ESCU - Investigate Network Traffic From src ip", "ESCU - Get Notable History"]
+investigative_searches = ["ESCU - Investigate Network Traffic From src ip", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Investigate Web Activity From src ip", "ESCU - Get Notable Info"]
 support_searches = []
 data_models = []
 providing_technologies = none
@@ -860,8 +860,8 @@ version = 1
 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
 detection_searches = ["ESCU - Abnormally High AWS Instances Launched by User - MLTK - Rule", "ESCU - Abnormally High AWS Instances Launched by User - Rule", "ESCU - Abnormally High AWS Instances Terminated by User - MLTK - Rule", "ESCU - Abnormally High AWS Instances Terminated by User - Rule", "ESCU - EC2 Instance Started In Previously Unseen Region - Rule", "ESCU - EC2 Instance Started With Previously Unseen User - Rule"]
 mappings = {"cis20": ["CIS 1", "CIS 12", "CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.AE", "DE.DP", "ID.AM"]}
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table", "ESCU - AWS Investigate User Activities By ARN", "ESCU - Get EC2 Instance Details by instanceId", "ESCU - Investigate AWS activities via region name", "ESCU - Get Notable History", "ESCU - Get EC2 Launch Details"]
-support_searches = ["ESCU - Previously Seen EC2 Launches By User", "ESCU - Baseline of Excessive AWS Instances Terminated by User - MLTK", "ESCU - Baseline of Excessive AWS Instances Launched by User - MLTK", "ESCU - Previously Seen AWS Regions"]
+investigative_searches = ["ESCU - Get User Information from Identity Table", "ESCU - AWS Investigate User Activities By ARN", "ESCU - Investigate AWS activities via region name", "ESCU - Get Notable History", "ESCU - Get EC2 Instance Details by instanceId", "ESCU - Get Notable Info", "ESCU - Get EC2 Launch Details"]
+support_searches = ["ESCU - Baseline of Excessive AWS Instances Terminated by User - MLTK", "ESCU - Previously Seen AWS Regions", "ESCU - Baseline of Excessive AWS Instances Launched by User - MLTK", "ESCU - Previously Seen EC2 Launches By User"]
 data_models = []
 providing_technologies = none
 description = Use the searches in this Analytic Story to monitor your AWS EC2 instances for evidence of anomalous activity and suspicious behaviors, such as EC2 instances that originate from unusual locations or those launched by previously unseen users (among others). Included investigative searches will help you probe more deeply, when the information warrants it.
@@ -877,7 +877,7 @@ reference = ["https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integr
 detection_searches = ["ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Detect new user AWS Console Login - Rule"]
 mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.AE", "DE.DP"]}
 investigative_searches = ["ESCU - AWS Investigate User Activities By ARN"]
-support_searches = ["ESCU - Previously seen users in CloudTrail", "ESCU - Update previously seen users in CloudTrail"]
+support_searches = ["ESCU - Update previously seen users in CloudTrail", "ESCU - Previously seen users in CloudTrail"]
 data_models = []
 providing_technologies = none
 description = Monitor your AWS authentication events using your CloudTrail logs. Searches within this Analytic Story will help you stay aware of and investigate suspicious logins. 
@@ -892,7 +892,7 @@ version = 2
 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://www.tripwire.com/state-of-security/security-data-protection/cloud/public-aws-s3-buckets-writable/"]
 detection_searches = ["ESCU - Detect New Open S3 buckets - Rule", "ESCU - Detect S3 access from a new IP - Rule", "ESCU - Detect Spike in S3 Bucket deletion - Rule"]
 mappings = {"cis20": ["CIS 13", "CIS 14"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.CM", "DE.DP", "PR.AC", "PR.DS"]}
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table", "ESCU - AWS Investigate User Activities By ARN", "ESCU - Get All AWS Activity From IP Address", "ESCU - AWS S3 Bucket details via bucketName", "ESCU - Investigate AWS activities via region name", "ESCU - Get Notable History"]
+investigative_searches = ["ESCU - Get User Information from Identity Table", "ESCU - AWS Investigate User Activities By ARN", "ESCU - Investigate AWS activities via region name", "ESCU - Get Notable History", "ESCU - Get All AWS Activity From IP Address", "ESCU - Get Notable Info", "ESCU - AWS S3 Bucket details via bucketName"]
 support_searches = ["ESCU - Baseline of S3 Bucket deletion activity by ARN", "ESCU - Previously seen S3 bucket access by remote IP"]
 data_models = []
 providing_technologies = none
@@ -910,7 +910,7 @@ version = 1
 reference = ["https://rhinosecuritylabs.com/aws/hiding-cloudcobalt-strike-beacon-c2-using-amazon-apis/"]
 detection_searches = ["ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule"]
 mappings = {"cis20": ["CIS 11"], "kill_chain_phases": ["Command and Control"], "nist": ["PR.AC"]}
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table", "ESCU - AWS Investigate User Activities By ARN", "ESCU - Get All AWS Activity From IP Address", "ESCU - Get DNS traffic ratio", "ESCU - AWS Network ACL Details from ID", "ESCU - Get Process Information For Port Activity", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Process Responsible For The DNS Traffic", "ESCU - Get Risk Modifiers For User", "ESCU - AWS Network Interface details via resourceId", "ESCU - Get DNS Server History for a host", "ESCU - Get Process Info", "ESCU - Get Notable History"]
+investigative_searches = ["ESCU - AWS Network ACL Details from ID", "ESCU - Get DNS Server History for a host", "ESCU - AWS Investigate User Activities By ARN", "ESCU - Get Process Responsible For The DNS Traffic", "ESCU - Get Notable History", "ESCU - Get Process Info", "ESCU - Get All AWS Activity From IP Address", "ESCU - Get DNS traffic ratio", "ESCU - Get Process Information For Port Activity", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - AWS Network Interface details via resourceId", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table"]
 support_searches = ["ESCU - Baseline of blocked outbound traffic from AWS"]
 data_models = []
 providing_technologies = none
@@ -929,8 +929,8 @@ version = 2
 reference = ["https://attack.mitre.org/wiki/Technique/T1059", "https://www.microsoft.com/en-us/wdsi/threats/macro-malware", "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"]
 detection_searches = ["ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule"]
 mappings = {"cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Exploitation"], "mitre_attack": ["T1036", "T1059", "T1064"], "nist": ["DE.CM", "PR.IP", "PR.PT"]}
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Registry Activities", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Parent Process Info", "ESCU - Investigate Web Activity From Host", "ESCU - Get Process Info", "ESCU - Get Notable History"]
-support_searches = ["ESCU - Previously seen command line arguments", "ESCU - Baseline of Command Line Length - MLTK"]
+investigative_searches = ["ESCU - Get Parent Process Info", "ESCU - Get Notable History", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Investigate Web Activity From Host", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Registry Activities"]
+support_searches = ["ESCU - Baseline of Command Line Length - MLTK", "ESCU - Previously seen command line arguments"]
 data_models = ["Endpoint"]
 providing_technologies = none
 description = Leveraging the Windows command-line interface (CLI) is one of the most common attack techniques--one that is also detailed in the MITRE ATT&CK framework. Use this Analytic Story to help you identify unusual or suspicious use of the CLI on Windows systems.
@@ -945,7 +945,7 @@ version = 1
 reference = ["http://blogs.splunk.com/2015/10/01/random-words-on-entropy-and-dns/", "http://www.darkreading.com/analytics/security-monitoring/got-malware-three-signs-revealed-in-dns-traffic/d/d-id/1139680", "https://live.paloaltonetworks.com/t5/Threat-Vulnerability-Articles/What-are-suspicious-DNS-queries/ta-p/71454"]
 detection_searches = ["ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Excessive DNS Failures - Rule"]
 mappings = {"cis20": ["CIS 1", "CIS 12", "CIS 13", "CIS 3", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1043", "T1048"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.DS", "PR.IP", "PR.PT"]}
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table", "ESCU - Get DNS traffic ratio", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Process Responsible For The DNS Traffic", "ESCU - Get Risk Modifiers For User", "ESCU - Get Parent Process Info", "ESCU - Get DNS Server History for a host", "ESCU - Get Process Info", "ESCU - Get Notable History"]
+investigative_searches = ["ESCU - Get DNS Server History for a host", "ESCU - Get Process Responsible For The DNS Traffic", "ESCU - Get Parent Process Info", "ESCU - Get Notable History", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get DNS traffic ratio", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table"]
 support_searches = ["ESCU - Baseline of DNS Query Length - MLTK"]
 data_models = ["Network_Resolution"]
 providing_technologies = none
@@ -961,7 +961,7 @@ version = 1
 reference = ["https://www.splunk.com/blog/2015/06/26/phishing-hits-a-new-level-of-quality/"]
 detection_searches = ["ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Suspicious Email - UBA Anomaly - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule"]
 mappings = {"cis20": ["CIS 12", "CIS 3", "CIS 7"], "kill_chain_phases": ["Delivery"], "nist": ["DE.AE", "PR.IP"]}
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table", "ESCU - Get Emails From Specific Sender", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Email Info", "ESCU - Investigate Web Activity From Host", "ESCU - Get Notable History"]
+investigative_searches = ["ESCU - Get Notable History", "ESCU - Get Risk Modifiers For User", "ESCU - Investigate Web Activity From Host", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Emails From Specific Sender", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Email Info", "ESCU - Get User Information from Identity Table"]
 support_searches = ["ESCU - DNSTwist Domain Names"]
 data_models = ["Email", "UEBA"]
 providing_technologies = none
@@ -981,8 +981,8 @@ version = 1
 reference = ["https://redcanary.com/blog/windows-registry-attacks-threat-detection/", "https://medium.com/@mbromileyDFIR/malware-monday-aebb456356c5", "https://attack.mitre.org/wiki/Technique/T1170"]
 detection_searches = ["ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Detect mshta exe running scripts in command-line arguments - Rule", "ESCU - Registry Keys Used For Persistence - Rule"]
 mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Exploitation"], "mitre_attack": ["T1059", "T1103", "T1131"], "nist": ["DE.AE", "DE.CM", "PR.PT"]}
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Registry Activities", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Parent Process Info", "ESCU - Investigate Web Activity From Host", "ESCU - Get Process Info", "ESCU - Get Notable History"]
-support_searches = ["ESCU - Previously seen command line arguments", "ESCU - Baseline of Command Line Length - MLTK"]
+investigative_searches = ["ESCU - Get Parent Process Info", "ESCU - Get Notable History", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Investigate Web Activity From Host", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Registry Activities"]
+support_searches = ["ESCU - Baseline of Command Line Length - MLTK", "ESCU - Previously seen command line arguments"]
 data_models = ["Endpoint"]
 providing_technologies = none
 description = Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code.
@@ -999,7 +999,7 @@ version = 1
 reference = ["https://attack.mitre.org/wiki/Technique/T1078", "https://owasp.org/www-community/attacks/Credential_stuffing", "https://searchsecurity.techtarget.com/answer/What-is-a-password-spraying-attack-and-how-does-it-work"]
 detection_searches = ["ESCU - Multiple Okta Users With Invalid Credentails From The Same IP - Rule", "ESCU - Okta Account Lockout Events - Rule", "ESCU - Okta Failed SSO Attempts - Rule", "ESCU - Okta User Logins From Multiple Cities - Rule"]
 mappings = {"cis20": ["CIS 16"], "mitre_attack": ["T1078"], "nist": ["DE.CM"]}
-investigative_searches = ["ESCU - Investigate Okta Activity by IP Address", "ESCU - Investigate Okta Activity by app", "ESCU - Investigate User Activities In Okta"]
+investigative_searches = ["ESCU - Investigate User Activities In Okta", "ESCU - Investigate Okta Activity by IP Address", "ESCU - Investigate Okta Activity by app"]
 support_searches = []
 data_models = []
 providing_technologies = none
@@ -1017,7 +1017,7 @@ version = 2
 reference = ["https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf", "https://www.fireeye.com/blog/threat-research/2017/03/wmimplant_a_wmi_ba.html"]
 detection_searches = ["ESCU - Process Execution via WMI - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Remote WMI Command Attempt - Rule", "ESCU - Script Execution via WMI - Rule", "ESCU - WMI Permanent Event Subscription - Rule", "ESCU - WMI Permanent Event Subscription - Sysmon - Rule", "ESCU - WMI Temporary Event Subscription - Rule"]
 mappings = {"cis20": ["CIS 3", "CIS 5"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1047", "T1084"], "nist": ["PR.AC", "PR.AT", "PR.IP", "PR.PT"]}
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Sysmon WMI Activity for Host", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Notable History"]
+investigative_searches = ["ESCU - Get Sysmon WMI Activity for Host", "ESCU - Get Parent Process Info", "ESCU - Get Notable History", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table"]
 support_searches = []
 data_models = ["Endpoint"]
 providing_technologies = none
@@ -1035,7 +1035,7 @@ version = 1
 reference = ["https://redcanary.com/blog/windows-registry-attacks-threat-detection/", "https://attack.mitre.org/wiki/Technique/T1112"]
 detection_searches = ["ESCU - Disabling Remote User Account Control - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Suspicious Changes to File Associations - Rule"]
 mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1015", "T1042", "T1103", "T1112", "T1131", "T1138"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.IP", "PR.PT"]}
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Registry Activities", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Parent Process Info", "ESCU - Investigate Web Activity From Host", "ESCU - Get Process Info", "ESCU - Get Notable History"]
+investigative_searches = ["ESCU - Get Parent Process Info", "ESCU - Get Notable History", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Investigate Web Activity From Host", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Registry Activities"]
 support_searches = []
 data_models = ["Endpoint"]
 providing_technologies = none
@@ -1053,7 +1053,7 @@ version = 1
 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
 detection_searches = ["ESCU - EC2 Instance Modified With Previously Unseen User - Rule"]
 mappings = {"cis20": ["CIS 1"], "nist": ["ID.AM"]}
-investigative_searches = ["ESCU - AWS Investigate User Activities By ARN", "ESCU - Get EC2 Instance Details by instanceId", "ESCU - Get Notable History"]
+investigative_searches = ["ESCU - AWS Investigate User Activities By ARN", "ESCU - Get Notable History", "ESCU - Get EC2 Instance Details by instanceId"]
 support_searches = ["ESCU - Previously Seen EC2 Modifications By User"]
 data_models = []
 providing_technologies = none
@@ -1070,7 +1070,7 @@ version = 2
 reference = ["https://www.fireeye.com/blog/threat-research/2017/08/monitoring-windows-console-activity-part-two.html", "https://www.splunk.com/pdfs/technical-briefs/advanced-threat-detection-and-response-tech-brief.pdf", "https://www.sans.org/reading-room/whitepapers/logging/detecting-security-incidents-windows-workstation-event-logs-34262"]
 detection_searches = ["ESCU - Detect Rare Executables - Rule", "ESCU - Detect processes used for System Network Configuration Discovery - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule"]
 mappings = {"cis20": ["CIS 2", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Installation"], "mitre_attack": ["T1015", "T1036", "T1085"], "nist": ["DE.CM", "ID.AM", "PR.DS", "PR.PT"]}
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Parent Process Info", "ESCU - Investigate Web Activity From Host", "ESCU - Get Process Info", "ESCU - Get Notable History"]
+investigative_searches = ["ESCU - Get Parent Process Info", "ESCU - Get Notable History", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Investigate Web Activity From Host", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table"]
 support_searches = ["ESCU - Baseline of Command Line Length - MLTK"]
 data_models = ["Endpoint"]
 providing_technologies = none
@@ -1088,7 +1088,7 @@ version = 1
 reference = ["https://www.monkey.org/~dugsong/dsniff/"]
 detection_searches = ["ESCU - Protocols passing authentication in cleartext - Rule"]
 mappings = {"cis20": ["CIS 14"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.DS"]}
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table", "ESCU - Get Process Information For Port Activity", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Notable History"]
+investigative_searches = ["ESCU - Get Notable History", "ESCU - Get Risk Modifiers For User", "ESCU - Get Process Information For Port Activity", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table"]
 support_searches = []
 data_models = ["Network_Traffic"]
 providing_technologies = none
@@ -1104,7 +1104,7 @@ version = 1
 reference = ["https://www.fbi.gov/scams-and-safety/common-fraud-schemes/internet-fraud", "https://www.fbi.gov/news/stories/2017-internet-crime-report-released-050718"]
 detection_searches = ["ESCU - Web Fraud - Account Harvesting - Rule", "ESCU - Web Fraud - Anomalous User Clickspeed - Rule", "ESCU - Web Fraud - Password Sharing Across Accounts - Rule"]
 mappings = {"cis20": ["CIS 16", "CIS 6"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078", "T1136"], "nist": ["DE.AE", "DE.CM", "DE.DP"]}
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get Web Session Information via session id", "ESCU - Get Emails From Specific Sender", "ESCU - Get Notable History"]
+investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get Notable History", "ESCU - Get Emails From Specific Sender", "ESCU - Get Web Session Information via session id"]
 support_searches = []
 data_models = []
 providing_technologies = none
@@ -1125,7 +1125,7 @@ version = 1
 reference = ["https://attack.mitre.org/wiki/Defense_Evasion"]
 detection_searches = ["ESCU - Disabling Remote User Account Control - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Suspicious Reg exe Process - Rule"]
 mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1089", "T1112"], "nist": ["DE.CM", "PR.PT"]}
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Registry Activities", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Notable History"]
+investigative_searches = ["ESCU - Get Parent Process Info", "ESCU - Get Notable History", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Registry Activities"]
 support_searches = []
 data_models = ["Endpoint"]
 providing_technologies = none
@@ -1141,7 +1141,7 @@ version = 1
 reference = ["https://blog.malwarebytes.com/cybercrime/2013/12/file-extensions-2/", "https://attack.mitre.org/wiki/Technique/T1042"]
 detection_searches = ["ESCU - Execution of File With Spaces Before Extension - Rule", "ESCU - Execution of File with Multiple Extensions - Rule", "ESCU - Suspicious Changes to File Associations - Rule"]
 mappings = {"cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1042"], "nist": ["DE.CM", "PR.IP", "PR.PT"]}
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Registry Activities", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Notable History"]
+investigative_searches = ["ESCU - Get Parent Process Info", "ESCU - Get Notable History", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Registry Activities"]
 support_searches = []
 data_models = ["Endpoint"]
 providing_technologies = none
@@ -1161,7 +1161,7 @@ version = 2
 reference = ["https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/", "https://zeltser.com/security-incident-log-review-checklist/", "http://journeyintoir.blogspot.com/2013/01/re-introducing-usnjrnl.html"]
 detection_searches = ["ESCU - Deleting Shadow Copies - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Windows Event Log Cleared - Rule"]
 mappings = {"cis20": ["CIS 10", "CIS 3", "CIS 5", "CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070"], "nist": ["DE.AE", "DE.CM", "DE.DP", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]}
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Parent Process Info", "ESCU - Investigate Web Activity From Host", "ESCU - Get Process Info", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Notable History"]
+investigative_searches = ["ESCU - Get Parent Process Info", "ESCU - Get Notable History", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Investigate Web Activity From Host", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table"]
 support_searches = []
 data_models = ["Endpoint"]
 providing_technologies = none
@@ -1178,7 +1178,7 @@ version = 2
 reference = ["http://www.fuzzysecurity.com/tutorials/19.html", "https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html", "http://resources.infosecinstitute.com/common-malware-persistence-mechanisms/", "https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html", "https://www.youtube.com/watch?v=dq2Hv7J9fvk"]
 detection_searches = ["ESCU - Detect Path Interception By Creation Of program exe - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Shim Database File Creation - Rule", "ESCU - Shim Database Installation With Suspicious Parameters - Rule"]
 mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Installation"], "mitre_attack": ["T1031", "T1050", "T1053", "T1089", "T1103", "T1131", "T1138"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]}
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Registry Activities", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Parent Process Info", "ESCU - Investigate Web Activity From Host", "ESCU - Get Process Info", "ESCU - Get Notable History"]
+investigative_searches = ["ESCU - Get Parent Process Info", "ESCU - Get Notable History", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Investigate Web Activity From Host", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Registry Activities"]
 support_searches = []
 data_models = ["Endpoint"]
 providing_technologies = none
@@ -1194,7 +1194,7 @@ version = 2
 reference = ["https://attack.mitre.org/tactics/TA0004/"]
 detection_searches = ["ESCU - Child Processes of Spoolsv exe - Rule", "ESCU - Overwriting Accessibility Binaries - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Uncommon Processes On Endpoint - Rule"]
 mappings = {"cis20": ["CIS 2", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Exploitation"], "mitre_attack": ["T1015", "T1068"], "nist": ["DE.CM", "ID.AM", "PR.DS", "PR.PT"]}
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Registry Activities", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Parent Process Info", "ESCU - Investigate Web Activity From Host", "ESCU - Get Process Info", "ESCU - Get Notable History"]
+investigative_searches = ["ESCU - Get Parent Process Info", "ESCU - Get Notable History", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Investigate Web Activity From Host", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Registry Activities"]
 support_searches = []
 data_models = ["Endpoint"]
 providing_technologies = none
@@ -1210,7 +1210,7 @@ version = 3
 reference = ["https://attack.mitre.org/wiki/Technique/T1050", "https://attack.mitre.org/wiki/Technique/T1031"]
 detection_searches = ["ESCU - First Time Seen Running Windows Service - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule"]
 mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Installation"], "mitre_attack": ["T1031", "T1050", "T1089"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]}
-investigative_searches = ["ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Notable History"]
+investigative_searches = ["ESCU - Get Parent Process Info", "ESCU - Get Notable History", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Notable Info", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get User Information from Identity Table"]
 support_searches = ["ESCU - Previously Seen Running Windows Services"]
 data_models = ["Endpoint"]
 providing_technologies = none
@@ -1,7 +1,7 @@
 <panel>
  <table>
    <search>
-      <query>`wineventlog_security` EventCode=4768 OR EventCode=4769 | stats count BY user, dest, EventCode | stats max(count) AS max_count sum(count) AS sum_count BY user, dest | where sum_count/max_count!=2</query>
+      <query>`wineventlog_security` EventCode=4768 OR EventCode=4769 | rex field=user "(?<new_user>[^\@]+)" | stats count BY new_user, dest, EventCode | stats max(count) AS max_count sum(count) AS sum_count BY new_user, dest | where sum_count/max_count!=2 | rename new_user AS user</query>
    </search>
    <option name="drilldown">cell</option>
    <option name="wrap">false</option>
@@ -3,79 +3,79 @@
 label = AWS Cross Account Activity
 description = Track when a user assumes an IAM role in another AWS account to obtain cross-account access to services and resources in that account. Accessing new roles could be an indication of malicious activity.
 disabled = 0
-panels = ["panel://workbench_panel_aws_investigate_user_activities_by_accesskeyid", "panel://workbench_panel_aws_investigate_user_activities_by_source_user", "panel://workbench_panel_get_notable_history"]
+panels = ["panel://workbench_panel_aws_investigate_user_activities_by_source_user", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_aws_investigate_user_activities_by_accesskeyid"]

 [panel_group://workbench_panel_group_aws_cryptomining]
 label = AWS Cryptomining
 description = Monitor your AWS EC2 instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or EC2 instances started by previously unseen users are just a few examples of potentially malicious behavior.
 disabled = 0
-panels = ["panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_aws_investigate_user_activities_by_arn", "panel://workbench_panel_get_ec2_instance_details_by_instanceid", "panel://workbench_panel_investigate_aws_activities_via_region_name", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_ec2_launch_details"]
+panels = ["panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_aws_investigate_user_activities_by_arn", "panel://workbench_panel_investigate_aws_activities_via_region_name", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_ec2_instance_details_by_instanceid", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_ec2_launch_details"]

 [panel_group://workbench_panel_group_aws_network_acl_activity]
 label = AWS Network ACL Activity
 description = Monitor your AWS network infrastructure for bad configurations and malicious activity. Investigative searches help you probe deeper, when the facts warrant it.
 disabled = 0
-panels = ["panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_aws_investigate_user_activities_by_arn", "panel://workbench_panel_get_all_aws_activity_from_ip_address", "panel://workbench_panel_get_dns_traffic_ratio", "panel://workbench_panel_aws_network_acl_details_from_id", "panel://workbench_panel_get_process_information_for_port_activity", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_aws_network_interface_details_via_resourceid", "panel://workbench_panel_get_dns_server_history_for_a_host", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_notable_history"]
+panels = ["panel://workbench_panel_aws_network_acl_details_from_id", "panel://workbench_panel_get_dns_server_history_for_a_host", "panel://workbench_panel_aws_investigate_user_activities_by_arn", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_all_aws_activity_from_ip_address", "panel://workbench_panel_get_dns_traffic_ratio", "panel://workbench_panel_get_process_information_for_port_activity", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_aws_network_interface_details_via_resourceid", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table"]

 [panel_group://workbench_panel_group_aws_suspicious_provisioning_activities]
 label = AWS Suspicious Provisioning Activities
 description = Monitor your AWS provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your network.
 disabled = 0
-panels = ["panel://workbench_panel_get_all_aws_activity_from_ip_address", "panel://workbench_panel_get_all_aws_activity_from_country", "panel://workbench_panel_get_all_aws_activity_from_city", "panel://workbench_panel_get_all_aws_activity_from_region"]
+panels = ["panel://workbench_panel_get_all_aws_activity_from_ip_address", "panel://workbench_panel_get_all_aws_activity_from_region", "panel://workbench_panel_get_all_aws_activity_from_country", "panel://workbench_panel_get_all_aws_activity_from_city"]

 [panel_group://workbench_panel_group_aws_user_monitoring]
 label = AWS User Monitoring
 description = Detect and investigate dormant user accounts for your AWS environment that have become active again. Because inactive and ad-hoc accounts are common attack targets, it's critical to enable governance within your environment.
 disabled = 0
-panels = ["panel://workbench_panel_get_notable_info", "panel://workbench_panel_investigate_aws_user_activities_by_user_field", "panel://workbench_panel_get_notable_history"]
+panels = ["panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_investigate_aws_user_activities_by_user_field"]

 [panel_group://workbench_panel_group_account_monitoring_and_controls]
 label = Account Monitoring and Controls
 description = A common attack technique is to leverage user accounts to gain unauthorized access to the target's network. This Analytic Story minimizes opportunities for attack by helping you actively manage creation/use/dormancy/deletion--the lifecycle of system and application accounts.
 disabled = 0
-panels = ["panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_logon_rights_modifications_for_endpoint", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_logon_rights_modifications_for_user", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_notable_history"]
+panels = ["panel://workbench_panel_get_logon_rights_modifications_for_endpoint", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_logon_rights_modifications_for_user", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table"]

 [panel_group://workbench_panel_group_apache_struts_vulnerability]
 label = Apache Struts Vulnerability
 description = Detect and investigate activities--such as unusually long `Content-Type` length, suspicious java classes and web servers executing suspicious processes--consistent with attempts to exploit Apache Struts vulnerabilities.
 disabled = 0
-panels = ["panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_investigate_web_posts_from_src", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_investigate_suspicious_strings_in_http_header", "panel://workbench_panel_get_notable_history"]
+panels = ["panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_investigate_suspicious_strings_in_http_header", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_investigate_web_posts_from_src", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table"]

 [panel_group://workbench_panel_group_asset_tracking]
 label = Asset Tracking
 description = Keep a careful inventory of every asset on your network to make it easier to detect rogue devices. Unauthorized/unmanaged devices could be an indication of malicious behavior that should be investigated further.
 disabled = 0
-panels = ["panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_first_occurrence_and_last_occurrence_of_a_mac_address", "panel://workbench_panel_get_notable_history"]
+panels = ["panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_first_occurrence_and_last_occurrence_of_a_mac_address"]

 [panel_group://workbench_panel_group_brand_monitoring]
 label = Brand Monitoring
 description = Detect and investigate activity that may indicate that an adversary is using faux domains to mislead users into interacting with malicious infrastructure. Monitor DNS, email, and web traffic for permutations of your brand name.
 disabled = 0
-panels = ["panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_emails_from_specific_sender", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_email_info", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_notable_history"]
+panels = ["panel://workbench_panel_get_process_responsible_for_the_dns_traffic", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_emails_from_specific_sender", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_email_info", "panel://workbench_panel_get_user_information_from_identity_table"]

 [panel_group://workbench_panel_group_cloud_cryptomining]
 label = Cloud Cryptomining
 description = Monitor your cloud compute instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or compute instances started by previously unseen users are just a few examples of potentially malicious behavior.
 disabled = 0
-panels = ["panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_investigate_user_activities_in_all_cloud_regions", "panel://workbench_panel_aws_investigate_user_activities_by_arn", "panel://workbench_panel_get_ec2_instance_details_by_instanceid", "panel://workbench_panel_investigate_aws_activities_via_region_name", "panel://workbench_panel_investigate_user_activities_in_single_cloud_region", "panel://workbench_panel_investigate_cloud_compute_instance_activities", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_ec2_launch_details"]
+panels = ["panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_aws_investigate_user_activities_by_arn", "panel://workbench_panel_investigate_aws_activities_via_region_name", "panel://workbench_panel_investigate_user_activities_in_single_cloud_region", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_investigate_user_activities_in_all_cloud_regions", "panel://workbench_panel_get_ec2_instance_details_by_instanceid", "panel://workbench_panel_investigate_cloud_compute_instance_activities", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_ec2_launch_details"]

 [panel_group://workbench_panel_group_coldroot_macos_rat]
 label = ColdRoot MacOS RAT
 description = Leverage searches that allow you to detect and investigate unusual activities that relate to the ColdRoot Remote Access Trojan that affects MacOS. An example of some of these activities are changing sensative binaries in the MacOS sub-system, detecting process names and executables associated with the RAT, detecting when a keyboard tab is installed on a MacOS machine and more.
 disabled = 0
-panels = ["panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_investigate_web_activity_from_src_ip", "panel://workbench_panel_investigate_network_traffic_from_src_ip", "panel://workbench_panel_get_vulnerability_logs_for_endpoint", "panel://workbench_panel_get_notable_history"]
+panels = ["panel://workbench_panel_investigate_network_traffic_from_src_ip", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_investigate_web_activity_from_src_ip", "panel://workbench_panel_get_vulnerability_logs_for_endpoint", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table"]

 [panel_group://workbench_panel_group_collection_and_staging]
 label = Collection and Staging
 description = Monitor for and investigate activities--such as suspicious writes to the Windows Recycling Bin or email servers sending high amounts of traffic to specific hosts, for example--that may indicate that an adversary is harvesting and exfiltrating sensitive data. 
 disabled = 0
-panels = ["panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_notable_history"]
+panels = ["panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table"]

 [panel_group://workbench_panel_group_command_and_control]
 label = Command and Control
 description = Detect and investigate tactics, techniques, and procedures leveraged by attackers to establish and operate command and control channels. Implants installed by attackers on compromised endpoints use these channels to receive instructions and send data back to the malicious operators.
 disabled = 0
-panels = ["panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_aws_investigate_user_activities_by_arn", "panel://workbench_panel_get_all_aws_activity_from_ip_address", "panel://workbench_panel_get_dns_traffic_ratio", "panel://workbench_panel_aws_network_acl_details_from_id", "panel://workbench_panel_get_process_information_for_port_activity", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_aws_network_interface_details_via_resourceid", "panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_dns_server_history_for_a_host", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_notable_history"]
+panels = ["panel://workbench_panel_aws_network_acl_details_from_id", "panel://workbench_panel_get_dns_server_history_for_a_host", "panel://workbench_panel_aws_investigate_user_activities_by_arn", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic", "panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_all_aws_activity_from_ip_address", "panel://workbench_panel_get_dns_traffic_ratio", "panel://workbench_panel_get_process_information_for_port_activity", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_aws_network_interface_details_via_resourceid", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table"]

 [panel_group://workbench_panel_group_common_phishing_frameworks]
 label = Common Phishing Frameworks
@@ -93,19 +93,19 @@ panels = ["panel://workbench_panel_investigate_aws_ecr_container_listing_activit
 label = Credential Dumping
 description = Uncover activity consistent with credential dumping, a technique wherein attackers compromise systems and attempt to obtain and exfiltrate passwords. The threat actors use these pilfered credentials to further escalate privileges and spread throughout a target environment. The included searches in this Analytic Story are designed to identify attempts to credential dumping.
 disabled = 0
-panels = ["panel://workbench_panel_investigate_previous_unseen_user", "panel://workbench_panel_investigate_failed_logins_for_multiple_destinations", "panel://workbench_panel_investigate_pass_the_ticket_attempts", "panel://workbench_panel_investigate_pass_the_hash_attempts"]
+panels = ["panel://workbench_panel_investigate_failed_logins_for_multiple_destinations", "panel://workbench_panel_investigate_previous_unseen_user", "panel://workbench_panel_investigate_pass_the_hash_attempts", "panel://workbench_panel_investigate_pass_the_ticket_attempts"]

 [panel_group://workbench_panel_group_dhs_report_ta18_074a]
 label = DHS Report TA18-074A
 description = Monitor for suspicious activities associated with DHS Technical Alert US-CERT TA18-074A. Some of the activities that adversaries used in these compromises included spearfishing attacks, malware, watering-hole domains, many and more.
 disabled = 0
-panels = ["panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_process_information_for_port_activity", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_registry_activities", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_process_file_activity", "panel://workbench_panel_get_process_registry_activity", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_vulnerability_logs_for_endpoint", "panel://workbench_panel_get_notable_history"]
+panels = ["panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_process_information_for_port_activity", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_process_registry_activity", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_vulnerability_logs_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_process_file_activity", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_registry_activities"]

 [panel_group://workbench_panel_group_dns_amplification_attacks]
 label = DNS Amplification Attacks
 description = DNS poses a serious threat as a Denial of Service (DOS) amplifier, if it responds to `ANY` queries. This Analytic Story can help you detect attackers who may be abusing your company's DNS infrastructure to launch amplification attacks, causing Denial of Service to other victims.
 disabled = 0
-panels = ["panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_risk_modifiers_for_endpoint"]
+panels = ["panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_risk_modifiers_for_endpoint"]

 [panel_group://workbench_panel_group_dns_hijacking]
 label = DNS Hijacking
@@ -117,73 +117,73 @@ panels = ["panel://workbench_panel_get_dns_server_history_for_a_host"]
 label = Data Protection
 description = Fortify your data-protection arsenal--while continuing to ensure data confidentiality and integrity--with searches that monitor for and help you investigate possible signs of data exfiltration.
 disabled = 0
-panels = ["panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_dns_traffic_ratio", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_dns_server_history_for_a_host", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_notable_history"]
+panels = ["panel://workbench_panel_get_dns_server_history_for_a_host", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_dns_traffic_ratio", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table"]

 [panel_group://workbench_panel_group_disabling_security_tools]
 label = Disabling Security Tools
 description = Looks for activities and techniques associated with the disabling of security tools on a Windows system, such as suspicious `reg.exe` processes, processes launching netsh, and many others.
 disabled = 0
-panels = ["panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_notable_history"]
+panels = ["panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table"]

 [panel_group://workbench_panel_group_dynamic_dns]
 label = Dynamic DNS
 description = Detect and investigate hosts in your environment that may be communicating with dynamic domain providers. Attackers may leverage these services to help them avoid firewall blocks and blacklists.
 disabled = 0
-panels = ["panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_dns_traffic_ratio", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_investigate_web_activity_from_src_ip", "panel://workbench_panel_get_dns_server_history_for_a_host", "panel://workbench_panel_get_notable_history"]
+panels = ["panel://workbench_panel_get_dns_server_history_for_a_host", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_dns_traffic_ratio", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_investigate_web_activity_from_src_ip", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table"]

 [panel_group://workbench_panel_group_emotet_malware__dhs_report_ta18_201a_]
 label = Emotet Malware  DHS Report TA18-201A 
 description = Detect rarely used executables, specific registry paths that may confer malware survivability and persistence, instances where cmd.exe is used to launch script interpreters, and other indicators that the Emotet financial malware has compromised your environment.
 disabled = 0
-panels = ["panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_process_information_for_port_activity", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_registry_activities", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_vulnerability_logs_for_endpoint", "panel://workbench_panel_get_update_logs_for_endpoint", "panel://workbench_panel_get_notable_history"]
+panels = ["panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_update_logs_for_endpoint", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_process_information_for_port_activity", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_vulnerability_logs_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_registry_activities"]

 [panel_group://workbench_panel_group_hidden_cobra_malware]
 label = Hidden Cobra Malware
 description = Monitor for and investigate activities, including the creation or deletion of hidden shares and file writes, that may be evidence of infiltration by North Korean government-sponsored cybercriminals. Details of this activity were reported in DHS Report TA-18-149A.
 disabled = 0
-panels = ["panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_dns_traffic_ratio", "panel://workbench_panel_get_process_information_for_port_activity", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_investigate_successful_remote_desktop_authentications", "panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_dns_server_history_for_a_host", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_vulnerability_logs_for_endpoint", "panel://workbench_panel_get_notable_history"]
+panels = ["panel://workbench_panel_get_dns_server_history_for_a_host", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic", "panel://workbench_panel_investigate_successful_remote_desktop_authentications", "panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_dns_traffic_ratio", "panel://workbench_panel_get_process_information_for_port_activity", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_vulnerability_logs_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table"]

 [panel_group://workbench_panel_group_host_redirection]
 label = Host Redirection
 description = Detect evidence of tactics used to redirect traffic from a host to a destination other than the one intended--potentially one that is part of an adversary's attack infrastructure. An example is redirecting communications regarding patches and updates or misleading users into visiting a malicious website.
 disabled = 0
-panels = ["panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_dns_server_history_for_a_host", "panel://workbench_panel_get_notable_history"]
+panels = ["panel://workbench_panel_get_dns_server_history_for_a_host", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table"]

 [panel_group://workbench_panel_group_jboss_vulnerability]
 label = JBoss Vulnerability
 description = In March of 2016, adversaries were seen using JexBoss--an open-source utility used for testing and exploiting JBoss application servers. These searches help detect evidence of these attacks, such as network connections to external resources or web services spawning atypical child processes, among others.
 disabled = 0
-panels = ["panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_vulnerability_logs_for_endpoint", "panel://workbench_panel_get_notable_history"]
+panels = ["panel://workbench_panel_get_notable_history", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_vulnerability_logs_for_endpoint", "panel://workbench_panel_get_notable_info"]

 [panel_group://workbench_panel_group_kubernetes_scanning_activity]
 label = Kubernetes Scanning Activity
 description = This story addresses detection against Kubernetes cluster fingerprint scan and attack by providing information on items such as source ip, user agent, cluster names.
 disabled = 0
-panels = ["panel://workbench_panel_get_notable_info", "panel://workbench_panel_gcp_kubernetes_activity_by_src_ip", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_amazon_eks_kubernetes_activity_by_src_ip", "panel://workbench_panel_get_notable_history"]
+panels = ["panel://workbench_panel_gcp_kubernetes_activity_by_src_ip", "panel://workbench_panel_amazon_eks_kubernetes_activity_by_src_ip", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_notable_info"]

 [panel_group://workbench_panel_group_lateral_movement]
 label = Lateral Movement
 description = Detect and investigate tactics, techniques, and procedures around how attackers move laterally within the enterprise. Because lateral movement can expose the adversary to detection, it should be an important focus for security analysts.
 disabled = 0
-panels = ["panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_process_information_for_port_activity", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_investigate_successful_remote_desktop_authentications", "panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_notable_history"]
+panels = ["panel://workbench_panel_investigate_successful_remote_desktop_authentications", "panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_process_information_for_port_activity", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table"]

 [panel_group://workbench_panel_group_malicious_powershell]
 label = Malicious PowerShell
 description = Attackers are finding stealthy ways "live off the land," leveraging utilities and tools that come standard on the endpoint--such as PowerShell--to achieve their goals without downloading binary files. These searches can help you detect and investigate PowerShell command-line options that may be indicative of malicious intent.
 disabled = 0
-panels = ["panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_notable_history"]
+panels = ["panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table"]

 [panel_group://workbench_panel_group_monitor_backup_solution]
 label = Monitor Backup Solution
 description = Address common concerns when monitoring your backup processes. These searches can help you reduce risks from ransomware, device theft, or denial of physical access to a host by backing up data on endpoints.
 disabled = 0
-panels = ["panel://workbench_panel_all_backup_logs_for_host", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_risk_modifiers_for_endpoint"]
+panels = ["panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_all_backup_logs_for_host"]

 [panel_group://workbench_panel_group_monitor_for_unauthorized_software]
 label = Monitor for Unauthorized Software
 description = Identify and investigate prohibited/unauthorized software or processes that may be concealing malicious behavior within your environment. 
 disabled = 0
-panels = ["panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_vulnerability_logs_for_endpoint", "panel://workbench_panel_get_update_logs_for_endpoint", "panel://workbench_panel_get_notable_history"]
+panels = ["panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_update_logs_for_endpoint", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_vulnerability_logs_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table"]

 [panel_group://workbench_panel_group_monitor_for_updates]
 label = Monitor for Updates
@@ -195,13 +195,13 @@ panels = ["panel://workbench_panel_get_notable_info", "panel://workbench_panel_g
 label = Netsh Abuse
 description = Detect activities and various techniques associated with the abuse of `netsh.exe`, which can disable local firewall settings or set up a remote connection to a host from an infected system.
 disabled = 0
-panels = ["panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_notable_history"]
+panels = ["panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table"]

 [panel_group://workbench_panel_group_orangeworm_attack_group]
 label = Orangeworm Attack Group
 description = Detect activities and various techniques associated with the Orangeworm Attack Group, a group that frequently targets the healthcare industry.
 disabled = 0
-panels = ["panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_notable_history"]
+panels = ["panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table"]

 [panel_group://workbench_panel_group_phishing_payloads]
 label = Phishing Payloads
@@ -213,25 +213,25 @@ panels = ["panel://workbench_panel_get_parent_process_info"]
 label = Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns
 description = Monitor your environment for suspicious behaviors that resemble the techniques employed by the MUDCARP threat group.
 disabled = 0
-panels = ["panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_registry_activities", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_notable_history"]
+panels = ["panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_registry_activities"]

 [panel_group://workbench_panel_group_prohibited_traffic_allowed_or_protocol_mismatch]
 label = Prohibited Traffic Allowed or Protocol Mismatch
 description = Detect instances of prohibited network traffic allowed in the environment, as well as protocols running on non-standard ports. Both of these types of behaviors typically violate policy and can be leveraged by attackers.
 disabled = 0
-panels = ["panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_process_information_for_port_activity", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_dns_server_history_for_a_host", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_notable_history"]
+panels = ["panel://workbench_panel_get_dns_server_history_for_a_host", "panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_process_information_for_port_activity", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table"]

 [panel_group://workbench_panel_group_ransomware]
 label = Ransomware
 description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware--spikes in SMB traffic, suspicious wevtutil usage, the presence of common ransomware extensions, and system processes run from unexpected locations, and many others.
 disabled = 0
-panels = ["panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_process_information_for_port_activity", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_registry_activities", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_sysmon_wmi_activity_for_host", "panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_backup_logs_for_endpoint", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_vulnerability_logs_for_endpoint", "panel://workbench_panel_get_update_logs_for_endpoint", "panel://workbench_panel_get_notable_history"]
+panels = ["panel://workbench_panel_get_sysmon_wmi_activity_for_host", "panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_update_logs_for_endpoint", "panel://workbench_panel_get_backup_logs_for_endpoint", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_process_information_for_port_activity", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_vulnerability_logs_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_registry_activities"]

 [panel_group://workbench_panel_group_router_and_infrastructure_security]
 label = Router and Infrastructure Security
 description = Validate the security configuration of network infrastructure and verify that only authorized users and systems are accessing critical assets. Core routing and switching infrastructure are common strategic targets for attackers.
 disabled = 0
-panels = ["panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_notable_history"]
+panels = ["panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table"]

 [panel_group://workbench_panel_group_sql_injection]
 label = SQL Injection
@@ -243,13 +243,13 @@ panels = ["panel://workbench_panel_get_notable_info", "panel://workbench_panel_g
 label = SamSam Ransomware
 description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the SamSam ransomware, including looking for file writes associated with SamSam, RDP brute force attacks, the presence of files with SamSam ransomware extensions, suspicious psexec use, and more.
 disabled = 0
-panels = ["panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_process_information_for_port_activity", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_investigate_successful_remote_desktop_authentications", "panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_backup_logs_for_endpoint", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_vulnerability_logs_for_endpoint", "panel://workbench_panel_get_update_logs_for_endpoint", "panel://workbench_panel_get_notable_history"]
+panels = ["panel://workbench_panel_investigate_successful_remote_desktop_authentications", "panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_update_logs_for_endpoint", "panel://workbench_panel_get_backup_logs_for_endpoint", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_process_information_for_port_activity", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_vulnerability_logs_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table"]

 [panel_group://workbench_panel_group_spectre_and_meltdown_vulnerabilities]
 label = Spectre And Meltdown Vulnerabilities
 description = Assess and mitigate your systems' vulnerability to Spectre and Meltdown exploitation with the searches in this Analytic Story.
 disabled = 0
-panels = ["panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_notable_history"]
+panels = ["panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table"]

 [panel_group://workbench_panel_group_splunk_enterprise_vulnerability]
 label = Splunk Enterprise Vulnerability
@@ -261,13 +261,13 @@ panels = ["panel://workbench_panel_get_notable_info", "panel://workbench_panel_g
 label = Splunk Enterprise Vulnerability CVE-2018-11409
 description = Reduce the risk of CVE-2018-11409, an information disclosure vulnerability within some older versions of Splunk Enterprise, with searches designed to help ensure that your Splunk system does not leak information to authenticated users.
 disabled = 0
-panels = ["panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_investigate_web_activity_from_src_ip", "panel://workbench_panel_investigate_network_traffic_from_src_ip", "panel://workbench_panel_get_notable_history"]
+panels = ["panel://workbench_panel_investigate_network_traffic_from_src_ip", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_investigate_web_activity_from_src_ip", "panel://workbench_panel_get_notable_info"]

 [panel_group://workbench_panel_group_suspicious_aws_ec2_activities]
 label = Suspicious AWS EC2 Activities
 description = Use the searches in this Analytic Story to monitor your AWS EC2 instances for evidence of anomalous activity and suspicious behaviors, such as EC2 instances that originate from unusual locations or those launched by previously unseen users (among others). Included investigative searches will help you probe more deeply, when the information warrants it.
 disabled = 0
-panels = ["panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_aws_investigate_user_activities_by_arn", "panel://workbench_panel_get_ec2_instance_details_by_instanceid", "panel://workbench_panel_investigate_aws_activities_via_region_name", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_ec2_launch_details"]
+panels = ["panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_aws_investigate_user_activities_by_arn", "panel://workbench_panel_investigate_aws_activities_via_region_name", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_ec2_instance_details_by_instanceid", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_ec2_launch_details"]

 [panel_group://workbench_panel_group_suspicious_aws_login_activities]
 label = Suspicious AWS Login Activities
@@ -279,115 +279,115 @@ panels = ["panel://workbench_panel_aws_investigate_user_activities_by_arn"]
 label = Suspicious AWS S3 Activities
 description = Use the searches in this Analytic Story to monitor your AWS S3 buckets for evidence of anomalous activity and suspicious behaviors, such as detecting open S3 buckets and buckets being accessed from a new IP. The contextual and investigative searches will give you more information, when required.
 disabled = 0
-panels = ["panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_aws_investigate_user_activities_by_arn", "panel://workbench_panel_get_all_aws_activity_from_ip_address", "panel://workbench_panel_aws_s3_bucket_details_via_bucketname", "panel://workbench_panel_investigate_aws_activities_via_region_name", "panel://workbench_panel_get_notable_history"]
+panels = ["panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_aws_investigate_user_activities_by_arn", "panel://workbench_panel_investigate_aws_activities_via_region_name", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_all_aws_activity_from_ip_address", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_aws_s3_bucket_details_via_bucketname"]

 [panel_group://workbench_panel_group_suspicious_aws_traffic]
 label = Suspicious AWS Traffic
 description = Leverage these searches to monitor your AWS network traffic for evidence of anomalous activity and suspicious behaviors, such as a spike in blocked outbound traffic in your virtual private cloud (VPC).
 disabled = 0
-panels = ["panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_aws_investigate_user_activities_by_arn", "panel://workbench_panel_get_all_aws_activity_from_ip_address", "panel://workbench_panel_get_dns_traffic_ratio", "panel://workbench_panel_aws_network_acl_details_from_id", "panel://workbench_panel_get_process_information_for_port_activity", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_aws_network_interface_details_via_resourceid", "panel://workbench_panel_get_dns_server_history_for_a_host", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_notable_history"]
+panels = ["panel://workbench_panel_aws_network_acl_details_from_id", "panel://workbench_panel_get_dns_server_history_for_a_host", "panel://workbench_panel_aws_investigate_user_activities_by_arn", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_all_aws_activity_from_ip_address", "panel://workbench_panel_get_dns_traffic_ratio", "panel://workbench_panel_get_process_information_for_port_activity", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_aws_network_interface_details_via_resourceid", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table"]

 [panel_group://workbench_panel_group_suspicious_command_line_executions]
 label = Suspicious Command-Line Executions
 description = Leveraging the Windows command-line interface (CLI) is one of the most common attack techniques--one that is also detailed in the MITRE ATT&CK framework. Use this Analytic Story to help you identify unusual or suspicious use of the CLI on Windows systems.
 disabled = 0
-panels = ["panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_registry_activities", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_notable_history"]
+panels = ["panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_registry_activities"]

 [panel_group://workbench_panel_group_suspicious_dns_traffic]
 label = Suspicious DNS Traffic
 description = Attackers often attempt to hide within or otherwise abuse the domain name system (DNS). You can thwart attempts to manipulate this omnipresent protocol by monitoring for these types of abuses.
 disabled = 0
-panels = ["panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_dns_traffic_ratio", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_dns_server_history_for_a_host", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_notable_history"]
+panels = ["panel://workbench_panel_get_dns_server_history_for_a_host", "panel://workbench_panel_get_process_responsible_for_the_dns_traffic", "panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_dns_traffic_ratio", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table"]

 [panel_group://workbench_panel_group_suspicious_emails]
 label = Suspicious Emails
 description = Email remains one of the primary means for attackers to gain an initial foothold within the modern enterprise. Detect and investigate suspicious emails in your environment with the help of the searches in this Analytic Story.
 disabled = 0
-panels = ["panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_emails_from_specific_sender", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_email_info", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_notable_history"]
+panels = ["panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_emails_from_specific_sender", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_email_info", "panel://workbench_panel_get_user_information_from_identity_table"]

 [panel_group://workbench_panel_group_suspicious_mshta_activity]
 label = Suspicious MSHTA Activity
 description = Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code.
 disabled = 0
-panels = ["panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_registry_activities", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_notable_history"]
+panels = ["panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_registry_activities"]

 [panel_group://workbench_panel_group_suspicious_okta_activity]
 label = Suspicious Okta Activity
 description = Monitor your Okta environment for suspicious activities. Due to the Covid outbreak, many users are migrating over to leverage cloud services more and more. Okta is a popular tool to manage multiple users and the web-based applications they need to stay productive. The searches in this story will help monitor your Okta environment for suspicious activities and associated user behaviors.
 disabled = 0
-panels = ["panel://workbench_panel_investigate_okta_activity_by_ip_address", "panel://workbench_panel_investigate_okta_activity_by_app", "panel://workbench_panel_investigate_user_activities_in_okta"]
+panels = ["panel://workbench_panel_investigate_user_activities_in_okta", "panel://workbench_panel_investigate_okta_activity_by_ip_address", "panel://workbench_panel_investigate_okta_activity_by_app"]

 [panel_group://workbench_panel_group_suspicious_wmi_use]
 label = Suspicious WMI Use
 description = Attackers are increasingly abusing Windows Management Instrumentation (WMI), a framework and associated utilities available on all modern Windows operating systems. Because WMI can be leveraged to manage both local and remote systems, it is important to identify the processes executed and the user context within which the activity occurred.
 disabled = 0
-panels = ["panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_sysmon_wmi_activity_for_host", "panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_notable_history"]
+panels = ["panel://workbench_panel_get_sysmon_wmi_activity_for_host", "panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table"]

 [panel_group://workbench_panel_group_suspicious_windows_registry_activities]
 label = Suspicious Windows Registry Activities
 description = Monitor and detect registry changes initiated from remote locations, which can be a sign that an attacker has infiltrated your system.
 disabled = 0
-panels = ["panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_registry_activities", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_notable_history"]
+panels = ["panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_registry_activities"]

 [panel_group://workbench_panel_group_unusual_aws_ec2_modifications]
 label = Unusual AWS EC2 Modifications
 description = Identify unusual changes to your AWS EC2 instances that may indicate malicious activity. Modifications to your EC2 instances by previously unseen users is an example of an activity that may warrant further investigation.
 disabled = 0
-panels = ["panel://workbench_panel_aws_investigate_user_activities_by_arn", "panel://workbench_panel_get_ec2_instance_details_by_instanceid", "panel://workbench_panel_get_notable_history"]
+panels = ["panel://workbench_panel_aws_investigate_user_activities_by_arn", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_ec2_instance_details_by_instanceid"]

 [panel_group://workbench_panel_group_unusual_processes]
 label = Unusual Processes
 description = Quickly identify systems running new or unusual processes in your environment that could be indicators of suspicious activity. Processes run from unusual locations, those with conspicuously long command lines, and rare executables are all examples of activities that may warrant deeper investigation.
 disabled = 0
-panels = ["panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_notable_history"]
+panels = ["panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table"]

 [panel_group://workbench_panel_group_use_of_cleartext_protocols]
 label = Use of Cleartext Protocols
 description = Leverage searches that detect cleartext network protocols that may leak credentials or should otherwise be encrypted.
 disabled = 0
-panels = ["panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_process_information_for_port_activity", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_notable_history"]
+panels = ["panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_process_information_for_port_activity", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_user_information_from_identity_table"]

 [panel_group://workbench_panel_group_web_fraud_detection]
 label = Web Fraud Detection
 description = Monitor your environment for activity consistent with common attack techniques bad actors use when attempting to compromise web servers or other web-related assets.
 disabled = 0
-panels = ["panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_web_session_information_via_session_id", "panel://workbench_panel_get_emails_from_specific_sender", "panel://workbench_panel_get_notable_history"]
+panels = ["panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_emails_from_specific_sender", "panel://workbench_panel_get_web_session_information_via_session_id"]

 [panel_group://workbench_panel_group_windows_defense_evasion_tactics]
 label = Windows Defense Evasion Tactics
 description = Detect tactics used by malware to evade defenses on Windows endpoints. A few of these include suspicious `reg.exe` processes, files hidden with `attrib.exe` and disabling user-account control, among many others 
 disabled = 0
-panels = ["panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_registry_activities", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_notable_history"]
+panels = ["panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_registry_activities"]

 [panel_group://workbench_panel_group_windows_file_extension_and_association_abuse]
 label = Windows File Extension and Association Abuse
 description = Detect and investigate suspected abuse of file extensions and Windows file associations. Some of the malicious behaviors involved may include inserting spaces before file extensions or prepending the file extension with a different one, among other techniques.
 disabled = 0
-panels = ["panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_registry_activities", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_notable_history"]
+panels = ["panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_registry_activities"]

 [panel_group://workbench_panel_group_windows_log_manipulation]
 label = Windows Log Manipulation
 description = Adversaries often try to cover their tracks by manipulating Windows logs. Use these searches to help you monitor for suspicious activity surrounding log files--an essential component of an effective defense.
 disabled = 0
-panels = ["panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_vulnerability_logs_for_endpoint", "panel://workbench_panel_get_notable_history"]
+panels = ["panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_vulnerability_logs_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table"]

 [panel_group://workbench_panel_group_windows_persistence_techniques]
 label = Windows Persistence Techniques
 description = Monitor for activities and techniques associated with maintaining persistence on a Windows system--a sign that an adversary may have compromised your environment.
 disabled = 0
-panels = ["panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_registry_activities", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_notable_history"]
+panels = ["panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_registry_activities"]

 [panel_group://workbench_panel_group_windows_privilege_escalation]
 label = Windows Privilege Escalation
 description = Monitor for and investigate activities that may be associated with a Windows privilege-escalation attack, including unusual processes running on endpoints, modified registry keys, and more.
 disabled = 0
-panels = ["panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_registry_activities", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_notable_history"]
+panels = ["panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_investigate_web_activity_from_host", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_registry_activities"]

 [panel_group://workbench_panel_group_windows_service_abuse]
 label = Windows Service Abuse
 description = Windows services are often used by attackers for persistence and the ability to load drivers or otherwise interact with the Windows kernel. This Analytic Story helps you monitor your environment for indications that Windows services are being modified or created in a suspicious manner.
 disabled = 0
-panels = ["panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_user_information_from_identity_table", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_notable_history"]
+panels = ["panel://workbench_panel_get_parent_process_info", "panel://workbench_panel_get_notable_history", "panel://workbench_panel_get_process_info", "panel://workbench_panel_get_risk_modifiers_for_user", "panel://workbench_panel_get_risk_modifiers_for_endpoint", "panel://workbench_panel_get_notable_info", "panel://workbench_panel_get_authentication_logs_for_endpoint", "panel://workbench_panel_get_user_information_from_identity_table"]



@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security-content
-# On Date: 2020-05-25T08:45:24 UTC
+# On Date: 2020-05-25T14:45:46 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security-content
-# On Date: 2020-05-25T08:45:24 UTC
+# On Date: 2020-05-25T14:45:46 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -605,7 +605,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count min(_time) as firstTime values(Processes.process) as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=certutil.exe (Processes.process=*-addstore* AND Processes.process=*disallowed* ) by Processes.parent_process Processes.process_name Processes.user | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)` | `attempt_to_add_certificate_to_untrusted_store_filter`
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime values(Processes.process) as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=certutil.exe (Processes.process=*-addstore* AND Processes.process=*disallowed* ) by Processes.parent_process Processes.process_name Processes.user | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `attempt_to_add_certificate_to_untrusted_store_filter`

 [ESCU - Attempt To Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule]
 action.escu = 0
@@ -645,7 +645,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path=*Software\\Microsoft\\Powershell\\1\\ShellIds\\Microsoft.PowerShell* Registry.registry_key_name=ExecutionPolicy (Registry.registry_value_name=Unrestricted OR Registry.registry_value_name=Bypass) by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter` 
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path=*Software\\Microsoft\\Powershell\\1\\ShellIds\\Microsoft.PowerShell* Registry.registry_key_name=ExecutionPolicy (Registry.registry_value_name=Unrestricted OR Registry.registry_value_name=Bypass) by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter`

 [ESCU - Attempt To Stop Security Service - Rule]
 action.escu = 0
@@ -824,7 +824,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Clients Connecting to Multiple DNS Servers - Rule
 action.escu.search_type = detection
 action.escu.providing_technologies = []
-action.escu.analytic_story = ["Command and Control", "Host Redirection", "Suspicious DNS Traffic", "DNS Hijacking"]
+action.escu.analytic_story = ["DNS Hijacking", "Command and Control", "Suspicious DNS Traffic", "Host Redirection"]
 cron_schedule = */30 * * * *
 dispatch.earliest_time = -30m
 dispatch.latest_time = now
@@ -1091,7 +1091,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Filesystem.user) as user values(Filesystem.dest) as dest values(Filesystem.file_path) as file_path from datamodel=Endpoint.Filesystem by Filesystem.file_name | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`|`ransomware_notes`| `common_ransomware_notes_filter`
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Filesystem.user) as user values(Filesystem.dest) as dest values(Filesystem.file_path) as file_path from datamodel=Endpoint.Filesystem by Filesystem.file_name | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `ransomware_notes` | `common_ransomware_notes_filter`

 [ESCU - Create Remote Thread into LSASS - Rule]
 action.escu = 0
@@ -1131,7 +1131,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `sysmon` EventID=8 TargetImage=*lsass.exe | stats count min(_time) as firstTime max(_time) as lastTime by Computer, EventCode, TargetImage, TargetProcessId | rename Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` |`create_remote_thread_into_lsass_filter`
+search = `sysmon` EventID=8 TargetImage=*lsass.exe | stats count min(_time) as firstTime max(_time) as lastTime by Computer, EventCode, TargetImage, TargetProcessId | rename Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `create_remote_thread_into_lsass_filter`

 [ESCU - Create local admin accounts using net exe - Rule]
 action.escu = 0
@@ -1171,7 +1171,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count values(Processes.user) as user values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processs.process_name=net.exe OR Processes.process_name=net1.exe) by Processes.process Processes.process_name Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`  | search (process=*localgroup* OR process=*/add* OR process=*user*) |`create_local_admin_accounts_using_net_exe_filter` 
+search = | tstats `security_content_summariesonly` count values(Processes.user) as user values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=net.exe OR Processes.process_name=net1.exe) AND (Processes.process=*localgroup* OR Processes.process=*/add* OR Processes.process=*user*) by Processes.process Processes.process_name Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` |`create_local_admin_accounts_using_net_exe_filter` 

 [ESCU - Create or delete windows shares using net exe - Rule]
 action.escu = 0
@@ -1211,7 +1211,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count values(Processes.user) as user values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processs.process_name=net.exe OR Processes.process_name=net1.exe) by Processes.process Processes.process_name Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | search (process=*share* AND process=*delete*) | `create_or_delete_windows_shares_using_net_exe_filter` 
+search = | tstats `security_content_summariesonly` count values(Processes.user) as user values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processs.process_name=net.exe OR Processes.process_name=net1.exe) by Processes.process Processes.process_name Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | search process=*share* | `create_or_delete_windows_shares_using_net_exe_filter` 

 [ESCU - Creation of Shadow Copy - Rule]
 action.escu = 0
@@ -1394,7 +1394,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - DNS Query Length Outliers - MLTK - Rule
 action.escu.search_type = detection
 action.escu.providing_technologies = []
-action.escu.analytic_story = ["Command and Control", "Hidden Cobra Malware", "Suspicious DNS Traffic"]
+action.escu.analytic_story = ["Hidden Cobra Malware", "Suspicious DNS Traffic", "Command and Control"]
 cron_schedule = */30 * * * *
 dispatch.earliest_time = -30m
 dispatch.latest_time = now
@@ -1434,7 +1434,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - DNS Query Length With High Standard Deviation - Rule
 action.escu.search_type = detection
 action.escu.providing_technologies = []
-action.escu.analytic_story = ["Command and Control", "Hidden Cobra Malware", "Suspicious DNS Traffic"]
+action.escu.analytic_story = ["Hidden Cobra Malware", "Suspicious DNS Traffic", "Command and Control"]
 cron_schedule = */30 * * * *
 dispatch.earliest_time = -30m
 dispatch.latest_time = now
@@ -1473,7 +1473,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule
 action.escu.search_type = detection
 action.escu.providing_technologies = []
-action.escu.analytic_story = ["Command and Control", "Host Redirection", "Suspicious DNS Traffic", "DNS Hijacking"]
+action.escu.analytic_story = ["DNS Hijacking", "Command and Control", "Suspicious DNS Traffic", "Host Redirection"]
 cron_schedule = */30 * * * *
 dispatch.earliest_time = -30m
 dispatch.latest_time = now
@@ -1557,7 +1557,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Deleting Shadow Copies - Rule
 action.escu.search_type = detection
 action.escu.providing_technologies = []
-action.escu.analytic_story = ["SamSam Ransomware", "Windows Log Manipulation", "Ransomware"]
+action.escu.analytic_story = ["Windows Log Manipulation", "SamSam Ransomware", "Ransomware"]
 cron_schedule = */30 * * * *
 dispatch.earliest_time = -30m
 dispatch.latest_time = now
@@ -2056,7 +2056,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect Long DNS TXT Record Response - Rule
 action.escu.search_type = detection
 action.escu.providing_technologies = []
-action.escu.analytic_story = ["Command and Control", "Suspicious DNS Traffic"]
+action.escu.analytic_story = ["Suspicious DNS Traffic", "Command and Control"]
 cron_schedule = */30 * * * *
 dispatch.earliest_time = -30m
 dispatch.latest_time = now
@@ -2745,7 +2745,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule
 action.escu.search_type = detection
 action.escu.providing_technologies = []
-action.escu.analytic_story = ["Command and Control", "AWS Network ACL Activity", "Suspicious AWS Traffic"]
+action.escu.analytic_story = ["AWS Network ACL Activity", "Suspicious AWS Traffic", "Command and Control"]
 cron_schedule = */30 * * * *
 dispatch.earliest_time = -30m
 dispatch.latest_time = now
@@ -2863,7 +2863,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule
 action.escu.search_type = detection
 action.escu.providing_technologies = []
-action.escu.analytic_story = ["Suspicious Command-Line Executions", "Emotet Malware  DHS Report TA18-201A "]
+action.escu.analytic_story = ["Emotet Malware  DHS Report TA18-201A ", "Suspicious Command-Line Executions"]
 cron_schedule = */30 * * * *
 dispatch.earliest_time = -30m
 dispatch.latest_time = now
@@ -2903,7 +2903,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule
 action.escu.search_type = detection
 action.escu.providing_technologies = []
-action.escu.analytic_story = ["SamSam Ransomware", "JBoss Vulnerability"]
+action.escu.analytic_story = ["JBoss Vulnerability", "SamSam Ransomware"]
 cron_schedule = */30 * * * *
 dispatch.earliest_time = -30m
 dispatch.latest_time = now
@@ -2949,7 +2949,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect hosts connecting to dynamic domain providers - Rule
 action.escu.search_type = detection
 action.escu.providing_technologies = []
-action.escu.analytic_story = ["Prohibited Traffic Allowed or Protocol Mismatch", "Suspicious DNS Traffic", "DNS Hijacking", "Dynamic DNS", "Command and Control", "Data Protection"]
+action.escu.analytic_story = ["Data Protection", "Prohibited Traffic Allowed or Protocol Mismatch", "DNS Hijacking", "Suspicious DNS Traffic", "Dynamic DNS", "Command and Control"]
 cron_schedule = */30 * * * *
 dispatch.earliest_time = -30m
 dispatch.latest_time = now
@@ -2988,7 +2988,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect malicious requests to exploit JBoss servers - Rule
 action.escu.search_type = detection
 action.escu.providing_technologies = []
-action.escu.analytic_story = ["SamSam Ransomware", "JBoss Vulnerability"]
+action.escu.analytic_story = ["JBoss Vulnerability", "SamSam Ransomware"]
 cron_schedule = */30 * * * *
 dispatch.earliest_time = -30m
 dispatch.latest_time = now
@@ -3230,7 +3230,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detection of DNS Tunnels - Rule
 action.escu.search_type = detection
 action.escu.providing_technologies = []
-action.escu.analytic_story = ["Command and Control", "Data Protection", "Suspicious DNS Traffic"]
+action.escu.analytic_story = ["Data Protection", "Suspicious DNS Traffic", "Command and Control"]
 cron_schedule = */30 * * * *
 dispatch.earliest_time = -30m
 dispatch.latest_time = now
@@ -3310,7 +3310,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Disabling Remote User Account Control - Rule
 action.escu.search_type = detection
 action.escu.providing_technologies = []
-action.escu.analytic_story = ["Suspicious Windows Registry Activities", "Windows Defense Evasion Tactics"]
+action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Suspicious Windows Registry Activities"]
 cron_schedule = */30 * * * *
 dispatch.earliest_time = -30m
 dispatch.latest_time = now
@@ -3590,7 +3590,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Email Attachments With Lots Of Spaces - Rule
 action.escu.search_type = detection
 action.escu.providing_technologies = []
-action.escu.analytic_story = ["Suspicious Emails", "Emotet Malware  DHS Report TA18-201A "]
+action.escu.analytic_story = ["Emotet Malware  DHS Report TA18-201A ", "Suspicious Emails"]
 cron_schedule = */30 * * * *
 dispatch.earliest_time = -30m
 dispatch.latest_time = now
@@ -3708,7 +3708,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Excessive DNS Failures - Rule
 action.escu.search_type = detection
 action.escu.providing_technologies = []
-action.escu.analytic_story = ["Command and Control", "Suspicious DNS Traffic"]
+action.escu.analytic_story = ["Suspicious DNS Traffic", "Command and Control"]
 cron_schedule = */30 * * * *
 dispatch.earliest_time = -30m
 dispatch.latest_time = now
@@ -3947,7 +3947,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - First time seen command line argument - Rule
 action.escu.search_type = detection
 action.escu.providing_technologies = []
-action.escu.analytic_story = ["Suspicious Command-Line Executions", "Hidden Cobra Malware", "DHS Report TA18-074A", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Orangeworm Attack Group"]
+action.escu.analytic_story = ["DHS Report TA18-074A", "Suspicious Command-Line Executions", "Orangeworm Attack Group", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Hidden Cobra Malware"]
 cron_schedule = */30 * * * *
 dispatch.earliest_time = -30m
 dispatch.latest_time = now
@@ -4065,7 +4065,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Hiding Files And Directories With Attrib exe - Rule
 action.escu.search_type = detection
 action.escu.providing_technologies = []
-action.escu.analytic_story = ["Windows Persistence Techniques", "Windows Defense Evasion Tactics"]
+action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Windows Persistence Techniques"]
 cron_schedule = */30 * * * *
 dispatch.earliest_time = -30m
 dispatch.latest_time = now
@@ -4073,7 +4073,7 @@ action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Hiding Files And Directories With Attrib exe - Rule
 schedule_window = auto
 action.notable = 1
-action.notable.param.nes_fields = ['user']
+action.notable.param.nes_fields = ['user', 'dest']
 action.notable.param.rule_description = Attackers leverage an existing Windows binary, attrib.exe, to mark specific as hidden by using specific flags so that the victim does not see the file.  The search looks for specific command-line arguments to detect the use of attrib.exe to hide files.
 action.notable.param.rule_title = Hiding Files And Directories With Attrib exe
 action.notable.param.security_domain = endpoint
@@ -4088,7 +4088,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count min(_time) values(Processes.process) as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=attrib.exe (Processes.process=*+h*) by Processes.parent_process Processes.process_name Processes.user | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`| `hiding_files_and_directories_with_attrib_exe_filter` 
+search = | tstats `security_content_summariesonly` count min(_time) values(Processes.process) as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=attrib.exe (Processes.process=*+h*) by Processes.parent_process Processes.process_name Processes.user Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`| `hiding_files_and_directories_with_attrib_exe_filter` 

 [ESCU - Hosts receiving high volume of network traffic from email server - Rule]
 action.escu = 0
@@ -4262,7 +4262,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule
 action.escu.search_type = detection
 action.escu.providing_technologies = []
-action.escu.analytic_story = ["Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Malicious PowerShell"]
+action.escu.analytic_story = ["Malicious PowerShell", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns"]
 cron_schedule = */30 * * * *
 dispatch.earliest_time = -30m
 dispatch.latest_time = now
@@ -4501,7 +4501,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Monitor Email For Brand Abuse - Rule
 action.escu.search_type = detection
 action.escu.providing_technologies = []
-action.escu.analytic_story = ["Suspicious Emails", "Brand Monitoring"]
+action.escu.analytic_story = ["Brand Monitoring", "Suspicious Emails"]
 cron_schedule = */30 * * * *
 dispatch.earliest_time = -30m
 dispatch.latest_time = now
@@ -4761,7 +4761,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `okta` displayMessage="Max sign in attempts exceeded" | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city | table _time, user, country, state, city, src_ip |`okta_account_lockout_events_filter` 
+search = `okta` displayMessage="Max sign in attempts exceeded" | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city | table _time, user, country, state, city, src_ip | `okta_account_lockout_events_filter` 

 [ESCU - Okta Failed SSO Attempts - Rule]
 action.escu = 0
@@ -4800,7 +4800,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `okta` displayMessage="User attempted unauthorized access to app" | stats  min(_time) as firstTime max(_time) as lastTime values(app) as Apps count by user, result ,displayMessage, src_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|`okta_failed_sso_attempts_filter` 
+search = `okta` displayMessage="User attempted unauthorized access to app" | stats  min(_time) as firstTime max(_time) as lastTime values(app) as Apps count by user, result ,displayMessage, src_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `okta_failed_sso_attempts_filter` 

 [ESCU - Okta User Logins From Multiple Cities - Rule]
 action.escu = 0
@@ -4840,7 +4840,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `okta` displayMessage="User login to Okta" client.geographicalContext.city!=null | stats min(_time) as firstTime max(_time) as lastTime dc(client.geographicalContext.city) as locations values(client.geographicalContext.city) as cities values(client.geographicalContext.state) as states by user | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` |`okta_user_logins_from_multiple_cities_filter`| search locations > 1
+search = `okta` displayMessage="User login to Okta" client.geographicalContext.city!=null | stats min(_time) as firstTime max(_time) as lastTime dc(client.geographicalContext.city) as locations values(client.geographicalContext.city) as cities values(client.geographicalContext.state) as states by user | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `okta_user_logins_from_multiple_cities_filter` | search locations > 1

 [ESCU - Open Redirect in Splunk Web - Rule]
 action.escu = 0
@@ -5134,7 +5134,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Prohibited Network Traffic Allowed - Rule
 action.escu.search_type = detection
 action.escu.providing_technologies = []
-action.escu.analytic_story = ["Command and Control", "Ransomware", "Prohibited Traffic Allowed or Protocol Mismatch"]
+action.escu.analytic_story = ["Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "Command and Control"]
 cron_schedule = */30 * * * *
 dispatch.earliest_time = -30m
 dispatch.latest_time = now
@@ -5173,7 +5173,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Prohibited Software On Endpoint - Rule
 action.escu.search_type = detection
 action.escu.providing_technologies = []
-action.escu.analytic_story = ["SamSam Ransomware", "Emotet Malware  DHS Report TA18-201A ", "Monitor for Unauthorized Software"]
+action.escu.analytic_story = ["Monitor for Unauthorized Software", "Emotet Malware  DHS Report TA18-201A ", "SamSam Ransomware"]
 cron_schedule = */30 * * * *
 dispatch.earliest_time = -30m
 dispatch.latest_time = now
@@ -5213,7 +5213,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Protocol or Port Mismatch - Rule
 action.escu.search_type = detection
 action.escu.providing_technologies = []
-action.escu.analytic_story = ["Command and Control", "Prohibited Traffic Allowed or Protocol Mismatch"]
+action.escu.analytic_story = ["Prohibited Traffic Allowed or Protocol Mismatch", "Command and Control"]
 cron_schedule = */30 * * * *
 dispatch.earliest_time = -30m
 dispatch.latest_time = now
@@ -5292,7 +5292,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule
 action.escu.search_type = detection
 action.escu.providing_technologies = []
-action.escu.analytic_story = ["Windows Persistence Techniques", "Windows Service Abuse"]
+action.escu.analytic_story = ["Windows Service Abuse", "Windows Persistence Techniques"]
 cron_schedule = */30 * * * *
 dispatch.earliest_time = -30m
 dispatch.latest_time = now
@@ -5300,7 +5300,7 @@ action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule
 schedule_window = auto
 action.notable = 1
-action.notable.param.nes_fields = ['dest']
+action.notable.param.nes_fields = ['user', 'dest']
 action.notable.param.rule_description = The search looks for reg.exe modifying registry keys that define Windows services and their configurations.
 action.notable.param.rule_title = Reg exe Manipulating Windows Services Registry Keys
 action.notable.param.security_domain = endpoint
@@ -5315,7 +5315,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.process_name) as process_name values(Processes.parent_process_name) as parent_process_name FROM datamodel=Endpoint.Processes where Processes.process_name = reg.exe by Processes.process_id Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | join [| tstats `security_content_summariesonly` values(Registry.registry_path) as registry_path count  FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\services\\*" by Registry.process_id Registry.dest | `drop_dm_object_name("Registry")` | table process_id dest registry_path] | `reg_exe_manipulating_windows_services_registry_keys_filter`
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.process_name) as process_name values(Processes.parent_process_name) as parent_process_name values(Processes.user) as user FROM datamodel=Endpoint.Processes where Processes.process_name = reg.exe by Processes.process_id Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | join [| tstats `security_content_summariesonly` values(Registry.registry_path) as registry_path count  FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\services\\*" by Registry.process_id Registry.dest | `drop_dm_object_name("Registry")` | table process_id dest registry_path] | `reg_exe_manipulating_windows_services_registry_keys_filter`

 [ESCU - Reg exe used to hide files directories via registry keys - Rule]
 action.escu = 0
@@ -5332,7 +5332,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Reg exe used to hide files directories via registry keys - Rule
 action.escu.search_type = detection
 action.escu.providing_technologies = []
-action.escu.analytic_story = ["Suspicious Windows Registry Activities", "Windows Persistence Techniques", "Windows Defense Evasion Tactics"]
+action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Suspicious Windows Registry Activities", "Windows Persistence Techniques"]
 cron_schedule = */30 * * * *
 dispatch.earliest_time = -30m
 dispatch.latest_time = now
@@ -5372,7 +5372,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Registry Keys Used For Persistence - Rule
 action.escu.search_type = detection
 action.escu.providing_technologies = []
-action.escu.analytic_story = ["Suspicious Windows Registry Activities", "Windows Persistence Techniques", "Emotet Malware  DHS Report TA18-201A ", "Ransomware", "DHS Report TA18-074A", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Suspicious MSHTA Activity"]
+action.escu.analytic_story = ["Suspicious Windows Registry Activities", "Suspicious MSHTA Activity", "DHS Report TA18-074A", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Ransomware", "Windows Persistence Techniques", "Emotet Malware  DHS Report TA18-201A "]
 cron_schedule = */30 * * * *
 dispatch.earliest_time = -30m
 dispatch.latest_time = now
@@ -5651,7 +5651,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Remote Registry Key modifications - Rule
 action.escu.search_type = detection
 action.escu.providing_technologies = []
-action.escu.analytic_story = ["Suspicious Windows Registry Activities", "Windows Persistence Techniques", "Windows Defense Evasion Tactics"]
+action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Suspicious Windows Registry Activities", "Windows Persistence Techniques"]
 cron_schedule = */30 * * * *
 dispatch.earliest_time = -30m
 dispatch.latest_time = now
@@ -5771,7 +5771,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - SMB Traffic Spike - Rule
 action.escu.search_type = detection
 action.escu.providing_technologies = []
-action.escu.analytic_story = ["Ransomware", "Emotet Malware  DHS Report TA18-201A ", "Hidden Cobra Malware", "DHS Report TA18-074A"]
+action.escu.analytic_story = ["Emotet Malware  DHS Report TA18-201A ", "Hidden Cobra Malware", "Ransomware", "DHS Report TA18-074A"]
 cron_schedule = */30 * * * *
 dispatch.earliest_time = -30m
 dispatch.latest_time = now
@@ -5814,7 +5814,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - SMB Traffic Spike - MLTK - Rule
 action.escu.search_type = detection
 action.escu.providing_technologies = []
-action.escu.analytic_story = ["Ransomware", "Emotet Malware  DHS Report TA18-201A ", "Hidden Cobra Malware", "DHS Report TA18-074A"]
+action.escu.analytic_story = ["Emotet Malware  DHS Report TA18-201A ", "Hidden Cobra Malware", "Ransomware", "DHS Report TA18-074A"]
 cron_schedule = */30 * * * *
 dispatch.earliest_time = -30m
 dispatch.latest_time = now
@@ -5934,7 +5934,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Sc exe Manipulating Windows Services - Rule
 action.escu.search_type = detection
 action.escu.providing_technologies = []
-action.escu.analytic_story = ["Windows Persistence Techniques", "Windows Service Abuse", "Disabling Security Tools", "DHS Report TA18-074A", "Orangeworm Attack Group"]
+action.escu.analytic_story = ["Windows Service Abuse", "DHS Report TA18-074A", "Orangeworm Attack Group", "Windows Persistence Techniques", "Disabling Security Tools"]
 cron_schedule = */30 * * * *
 dispatch.earliest_time = -30m
 dispatch.latest_time = now
@@ -6534,7 +6534,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Suspicious Email Attachment Extensions - Rule
 action.escu.search_type = detection
 action.escu.providing_technologies = []
-action.escu.analytic_story = ["Suspicious Emails", "Emotet Malware  DHS Report TA18-201A "]
+action.escu.analytic_story = ["Emotet Malware  DHS Report TA18-201A ", "Suspicious Emails"]
 cron_schedule = */30 * * * *
 dispatch.earliest_time = -30m
 dispatch.latest_time = now
@@ -6693,7 +6693,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Suspicious Reg exe Process - Rule
 action.escu.search_type = detection
 action.escu.providing_technologies = []
-action.escu.analytic_story = ["Disabling Security Tools", "Windows Defense Evasion Tactics", "DHS Report TA18-074A"]
+action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Disabling Security Tools", "DHS Report TA18-074A"]
 cron_schedule = */30 * * * *
 dispatch.earliest_time = -30m
 dispatch.latest_time = now
@@ -6852,7 +6852,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - System Processes Run From Unexpected Locations - Rule
 action.escu.search_type = detection
 action.escu.providing_technologies = []
-action.escu.analytic_story = ["Suspicious Command-Line Executions", "Ransomware", "Unusual Processes"]
+action.escu.analytic_story = ["Suspicious Command-Line Executions", "Unusual Processes", "Ransomware"]
 cron_schedule = */30 * * * *
 dispatch.earliest_time = -30m
 dispatch.latest_time = now
@@ -6892,7 +6892,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - TOR Traffic - Rule
 action.escu.search_type = detection
 action.escu.providing_technologies = []
-action.escu.analytic_story = ["Command and Control", "Ransomware", "Prohibited Traffic Allowed or Protocol Mismatch"]
+action.escu.analytic_story = ["Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "Command and Control"]
 cron_schedule = */30 * * * *
 dispatch.earliest_time = -30m
 dispatch.latest_time = now
@@ -7074,7 +7074,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `sysmon` EventID=7 Image=*lsass.exe Signed=false | stats count min(_time) as firstTime max(_time) as lastTime by Computer, Image, ImageLoaded, Signed, SHA1 | rename Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `unsigned_image_loaded_by_lsass_filter` 
+search = `sysmon` EventID=7 Image=*lsass.exe Signed=false | stats count min(_time) as firstTime max(_time) as lastTime by Computer, Image, ImageLoaded, Signed, SHA1 | rename Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `unsigned_image_loaded_by_LSAS`unsigned_image_loaded_by_lsass_filter` 

 [ESCU - Unsuccessful Netbackup backups - Rule]
 action.escu = 0
@@ -7130,7 +7130,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Unusually Long Command Line - Rule
 action.escu.search_type = detection
 action.escu.providing_technologies = []
-action.escu.analytic_story = ["Ransomware", "Suspicious Command-Line Executions", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Unusual Processes"]
+action.escu.analytic_story = ["Suspicious Command-Line Executions", "Unusual Processes", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Ransomware"]
 cron_schedule = */30 * * * *
 dispatch.earliest_time = -30m
 dispatch.latest_time = now
@@ -7153,7 +7153,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.dest Processes.process_name Processes.process | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|  eval processlen=len(process) | eventstats stdev(processlen) as stdev, avg(processlen) as avg by dest | stats max(processlen) as maxlen, values(stdev) as stdevperhost, values(avg) as avgperhost by dest, user, process_name, process| `unusually_long_command_line_filter`  eval threshold = 10 | where maxlen > ((threshold*stdevperhost) + avgperhost)
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.dest Processes.process_name Processes.process | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|  eval processlen=len(process) | eventstats stdev(processlen) as stdev, avg(processlen) as avg by dest | stats max(processlen) as maxlen, values(stdev) as stdevperhost, values(avg) as avgperhost by dest, user, process_name, process | `unusually_long_command_line_filter` |eval threshold = 10 | where maxlen > ((threshold*stdevperhost) + avgperhost)

 [ESCU - Unusually Long Command Line - MLTK - Rule]
 action.escu = 0
@@ -7170,7 +7170,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Unusually Long Command Line - MLTK - Rule
 action.escu.search_type = detection
 action.escu.providing_technologies = []
-action.escu.analytic_story = ["Ransomware", "Suspicious Command-Line Executions", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Unusual Processes"]
+action.escu.analytic_story = ["Suspicious Command-Line Executions", "Unusual Processes", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Ransomware"]
 cron_schedule = */30 * * * *
 dispatch.earliest_time = -30m
 dispatch.latest_time = now
@@ -7391,7 +7391,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `stream_http` http_content_type=text* uri="/magento2/customer/account/loginPost/" | rex field=cookie "form_key=(?<SessionID>\w+)" | rex field=form_data "login\[username\]=(?<Username>[^&|^$]+)" | search Username=* | rex field=Username "@(?<email_domain>.*)"|stats dc(Username) as UniqueUsernames list(Username) as src_user by email_domain|where UniqueUsernames> 25 | `web_fraud___account_harvesting_filter`
+search = `stream_http` http_content_type=text* uri="/magento2/customer/account/loginPost/" | rex field=cookie "form_key=(?<SessionID>\w+)" | rex field=form_data "login\[username\]=(?<Username>[^&|^$]+)" | search Username=* | rex field=Username "@(?<email_domain>.*)" | stats dc(Username) as UniqueUsernames list(Username) as src_user by email_domain | where UniqueUsernames> 25 | `web_fraud___account_harvesting_filter`

 [ESCU - Web Fraud - Anomalous User Clickspeed - Rule]
 action.escu = 0
@@ -9536,7 +9536,7 @@ action.escu.known_false_positives = None at this time
 disabled = true
 schedule_window = auto
 is_visible = false
-search = `wineventlog_security` EventCode=4768 OR EventCode=4769 | stats count BY user, dest, EventCode | stats max(count) AS max_count sum(count) AS sum_count BY user, dest | where sum_count/max_count!=2
+search = `wineventlog_security` EventCode=4768 OR EventCode=4769 | rex field=user "(?<new_user>[^\@]+)" | stats count BY new_user, dest, EventCode | stats max(count) AS max_count sum(count) AS sum_count BY new_user, dest | where sum_count/max_count!=2 | rename new_user AS user

 [ESCU - Investigate Previous Unseen User - Response Task]
 action.escu = 0
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security-content
-# On Date: 2020-05-25T08:45:24 UTC
+# On Date: 2020-05-25T14:45:46 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############