diff --git a/detections/endpoint/detect_mshta_exe_running_scripts_in_command_line_arguments.yml b/detections/endpoint/detect_mshta_exe_running_scripts_in_command_line_arguments.yml
deleted file mode 100644
index 969b649917..0000000000
--- a/detections/endpoint/detect_mshta_exe_running_scripts_in_command_line_arguments.yml
+++ /dev/null
@@ -1,41 +0,0 @@
-name: Detect mshta exe running scripts in command-line arguments
-id: b89919ed-fe5f-492c-b139-95dqb161039e
-version: 4
-date: '2020-11-09'
-description: This search looks for the execution of "mshta.exe" with command-line
-  arguments that launch a script. The search will return the first time and last time
-  these command-line arguments were used for these executions, as well as the target
-  system, the user, process "mshta.exe" and its parent process.
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
-type: ESCU
-references: []
-author: Bhavin Patel, Splunk
-search: '| tstats `security_content_summariesonly` count values(Processes.process)
-  as process values(Processes.parent_process) as parent_process min(_time) as firstTime
-  max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=mshta.exe
-  (Processes.process=*vbscript* OR Processes.process=*javascript*) by Processes.user
-  Processes.process_name Processes.parent_process_name Processes.dest  | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| search
-  (process=*vbscript* OR process=*javascript*) | `detect_mshta_exe_running_scripts_in_command_line_arguments_filter`'
-known_false_positives: Although unlikely, some legitimate applications may exhibit
-  this behavior, triggering a false positive.
-tags:
-  analytics_story:
-  - Suspicious MSHTA Activity
-  mitre_attack_id:
-  - T1218.005
-  kill_chain_phases:
-  - Exploitation
-  cis20:
-  - CIS 8
-  nist:
-  - PR.PT
-  - DE.CM
-  security_domain: endpoint
-  asset_type: Endpoint
-  automated_detection_testing: passed
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log
diff --git a/detections/endpoint/detect_mshta_inline_hta_execution.yml b/detections/endpoint/detect_mshta_inline_hta_execution.yml
new file mode 100644
index 0000000000..414d02c1e3
--- /dev/null
+++ b/detections/endpoint/detect_mshta_inline_hta_execution.yml
@@ -0,0 +1,45 @@
+name: Detect mshta inline hta execution
+id: a0873b32-5b68-11eb-ae93-0242ac130002
+version: 5
+date: '2021-01-20'
+description: The following analytic identifies "mshta.exe" execution with inline
+  protocol handlers. "JavaScript", "VBScript", and "About" are the only supported
+  options when invoking HTA content directly on the command-line. The search will 
+  return the first time and last time these command-line arguments were used for 
+  these executions, as well as the target system, the user, process "mshta.exe" 
+  and its parent process.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+type: ESCU
+references:
+- https://github.com/redcanaryco/AtomicTestHarnesses
+- https://redcanary.com/blog/introducing-atomictestharnesses/
+- https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing
+author: Bhavin Patel, Michael Haag, Splunk
+search: '| tstats `security_content_summariesonly` count values(Processes.process)
+  as process values(Processes.parent_process) as parent_process min(_time) as firstTime
+  max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=mshta.exe
+  (Processes.process=*vbscript* OR Processes.process=*javascript* OR Processes.process=*about*) by Processes.user
+  Processes.process_name Processes.parent_process_name Processes.dest  | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` 
+  | `detect_mshta_inline_hta_execution_filter`'
+known_false_positives: Although unlikely, some legitimate applications may exhibit
+  this behavior, triggering a false positive.
+tags:
+  analytics_story:
+  - Suspicious MSHTA Activity
+  mitre_attack_id:
+  - T1218.005
+  kill_chain_phases:
+  - Exploitation
+  cis20:
+  - CIS 8
+  nist:
+  - PR.PT
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log
diff --git a/detections/endpoint/detect_mshta_renamed.yml b/detections/endpoint/detect_mshta_renamed.yml
new file mode 100644
index 0000000000..8a0442f6c9
--- /dev/null
+++ b/detections/endpoint/detect_mshta_renamed.yml
@@ -0,0 +1,41 @@
+name: Detect mshta renamed
+id: 8f45fcf0-5b68-11eb-ae93-0242ac130002
+version: 1
+date: '2021-01-20'
+description: The following analytic identifies renamed instances of mshta.exe executing.
+  Mshta.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. This
+  analytic utilizes the internal name of the PE to identify if is the legitimate
+  mshta binary. Further analysis should be performed to review the executed content 
+  and validation it is the real mshta. 
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+type: ESCU
+references:
+- https://github.com/redcanaryco/AtomicTestHarnesses
+- https://redcanary.com/blog/introducing-atomictestharnesses/
+author: Michael Haag, Splunk
+search: '`sysmon` EventID=1 (OriginalFileName=mshta.exe AND process_name!=mshta.exe)
+  | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User,
+  parent_process_name, process_name, OriginalFileName, process_path, CommandLine |
+  rename Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
+  `detect_mshta_renamed_filter`'
+known_false_positives: Although unlikely, some legitimate applications may use a moved
+  copy of mshta.exe, but never renamed, triggering a false positive.
+tags:
+  analytics_story:
+  - Suspicious MSHTA Activity
+  mitre_attack_id:
+  - T1218.005
+  kill_chain_phases:
+  - Exploitation
+  cis20:
+  - CIS 8
+  nist:
+  - PR.PT
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/windows-sysmon.log
diff --git a/detections/endpoint/detect_mshta_url_in_command_line.yml b/detections/endpoint/detect_mshta_url_in_command_line.yml
new file mode 100644
index 0000000000..3a57d4fa7f
--- /dev/null
+++ b/detections/endpoint/detect_mshta_url_in_command_line.yml
@@ -0,0 +1,45 @@
+name: Detect MSHTA Url in Command Line
+id: 9b3af1e6-5b68-11eb-ae93-0242ac130002
+version: 1
+date: '2021-01-20'
+description: This analytic identifies when Microsoft HTML Application Host (mshta.exe)
+  utility is used to make remote http connections. Adversaries may use mshta.exe to
+  proxy the download and execution of remote .hta files. The analytic identifies command
+  line arguments of http and https being used. This technique is commonly used by
+  malicious software to bypass preventative controls. The search will return the first
+  time and last time these command-line arguments were used for these executions,
+  as well as the target system, the user, process "rundll32.exe" and its parent process.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+type: ESCU
+references:
+- https://github.com/redcanaryco/AtomicTestHarnesses
+- https://redcanary.com/blog/introducing-atomictestharnesses/
+- https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing
+author: Michael Haag, Splunk
+search: '| tstats `security_content_summariesonly` count values(Processes.process)
+  as process values(Processes.parent_process) as parent_process min(_time) as firstTime
+  max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=mshta.exe
+  (Processes.process="*http://*" OR Processes.process="*https://*") by Processes.user
+  Processes.process_name Processes.parent_process_name Processes.dest  | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_mshta_url_in_command_line_filter`'
+known_false_positives: It is possible legitimate applications may perform this behavior
+  and will need to be filtered.
+tags:
+  analytics_story:
+  - Suspicious MSHTA Activity
+  mitre_attack_id:
+  - T1218.005
+  kill_chain_phases:
+  - Exploitation
+  cis20:
+  - CIS 8
+  nist:
+  - PR.PT
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log
+  automated_detection_testing: passed
diff --git a/detections/endpoint/detect_rundll32_inline_hta_execution.yml b/detections/endpoint/detect_rundll32_inline_hta_execution.yml
new file mode 100644
index 0000000000..194a204078
--- /dev/null
+++ b/detections/endpoint/detect_rundll32_inline_hta_execution.yml
@@ -0,0 +1,46 @@
+name: Detect Rundll32 Inline HTA Execution
+id: 91c79f14-5b41-11eb-ae93-0242ac130002
+version: 1
+date: '2021-01-20'
+description: The following analytic identifies "rundll32.exe" execution with inline
+  protocol handlers. "JavaScript", "VBScript", and "About" are the only supported
+  options when invoking HTA content directly on the command-line. This type of behavior
+  is commonly observed with fileless malware or application whitelisting bypass techniques.
+  The search will return the first time and last time these command-line arguments
+  were used for these executions, as well as the target system, the user, process
+  "rundll32.exe" and its parent process.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+type: ESCU
+references:
+- https://github.com/redcanaryco/AtomicTestHarnesses
+- https://redcanary.com/blog/introducing-atomictestharnesses/
+- https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing
+author: Michael Haag, Splunk
+search: '| tstats `security_content_summariesonly` count values(Processes.process)
+  as process values(Processes.parent_process) as parent_process min(_time) as firstTime
+  max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe
+  (Processes.process=*vbscript* OR Processes.process=*javascript* OR Processes.process=*about*)
+  by Processes.user Processes.process_name Processes.parent_process_name Processes.dest  |
+  `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
+  | `detect_rundll32_inline_hta_execution_filter`'
+known_false_positives: Although unlikely, some legitimate applications may exhibit
+  this behavior, triggering a false positive.
+tags:
+  analytics_story:
+  - Suspicious MSHTA Activity
+  mitre_attack_id:
+  - T1218.005
+  kill_chain_phases:
+  - Exploitation
+  cis20:
+  - CIS 8
+  nist:
+  - PR.PT
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log
+  automated_detection_testing: passed
diff --git a/detections/endpoint/nltest_domain_trust_discovery.yml b/detections/endpoint/nltest_domain_trust_discovery.yml
new file mode 100644
index 0000000000..05b3db139b
--- /dev/null
+++ b/detections/endpoint/nltest_domain_trust_discovery.yml
@@ -0,0 +1,47 @@
+name: NLTest Domain Trust Discovery
+id: c3e05466-5f22-11eb-ae93-0242ac130002
+version: 1
+date: '2021-01-25'
+description: This search looks for the execution of `nltest.exe` with command-line
+  arguments utilized to query for Domain Trust information. Two arguments `/domain
+  trusts`, returns a list of trusted domains, and `/all_trusts`, returns all trusted
+  domains. Red Teams and adversaries alike use NLTest.exe to enumerate the current
+  domain to assist with further understanding where to pivot next.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+type: ESCU
+references:
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1482/T1482.md
+- https://malware.news/t/lets-learn-trickbot-implements-network-collector-module-leveraging-cmd-wmi-ldap/19104
+- https://attack.mitre.org/techniques/T1482/
+- https://www.owasp.org/images/4/4b/Red_Team_Operating_in_a_Modern_Environment.pdf
+- https://ss64.com/nt/nltest.html
+- https://redcanary.com/threat-detection-report/techniques/domain-trust-discovery/
+- https://thedfirreport.com/2020/10/08/ryuks-return/
+author: Michael Haag, Splunk
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=nltest.exe
+  OR Processes.process_name!=nltest.exe) (Processes.process=*/domain_trusts* OR Processes.process=*/all_trusts*)
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `nltest_domain_trust_discovery_filter`'
+known_false_positives: Administrators may use nltest for troubleshooting purposes,
+  otherwise, rarely used.
+tags:
+  analytics_story:
+  - Ryuk Ransomware
+  mitre_attack_id:
+  - T1482
+  kill_chain_phases:
+  - Exploitation
+  cis20:
+  - CIS 8
+  nist:
+  - PR.PT
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1482/atomic_red_team/windows-sysmon.log
+  automated_detection_testing: passed
diff --git a/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml b/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml
new file mode 100644
index 0000000000..6ec574c916
--- /dev/null
+++ b/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml
@@ -0,0 +1,43 @@
+name: Suspicious microsoft workflow compiler rename
+id: f0db4464-55d9-11eb-ae93-0242ac130002
+version: 1
+date: '2021-01-12'
+description: The following analytic identifies a renamed instance of microsoft.workflow.compiler.exe.
+  Microsoft.workflow.compiler.exe is natively found in C:\Windows\Microsoft.NET\Framework64\v4.0.30319
+  and is rarely utilized. When investigating, identify the executed code on disk and
+  review. A spawned child process from microsoft.workflow.compiler.exe is uncommon.
+  In any instance, microsoft.workflow.compiler.exe spawning from an Office product
+  or any living off the land binary is highly suspect.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+type: ESCU
+references:
+- https://lolbas-project.github.io/lolbas/Binaries/Microsoft.Workflow.Compiler/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218/T1218.md#atomic-test-6---microsoftworkflowcompilerexe-payload-execution
+author: Michael Haag, Splunk
+search: '`sysmon` EventID=1 (OriginalFileName=microsoft.workflow.compiler.exe OR process_name=microsoft.workflow.compiler.exe)
+  | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User,
+  parent_process_name, process_name, OriginalFileName, process_path, CommandLine |
+  rename Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
+  `suspicious_microsoft_workflow_compiler_rename_filter`'
+known_false_positives: Although unlikely, some legitimate applications may use a moved
+  copy of microsoft.workflow.compiler.exe, triggering a false positive.
+tags:
+  analytics_story:
+  - Trusted Developer Utilities Proxy Execution
+  mitre_attack_id:
+  - T1127, T1036.003
+  kill_chain_phases:
+  - Exploitation
+  cis20:
+  - CIS 8
+  nist:
+  - PR.PT
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127/windows-sysmon.log
+  automated_detection_testing: passed
diff --git a/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml b/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml
new file mode 100644
index 0000000000..6aa74baac1
--- /dev/null
+++ b/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml
@@ -0,0 +1,40 @@
+name: Suspicious microsoft workflow compiler usage
+id: 9bbc62e8-55d8-11eb-ae93-0242ac130002
+version: 1
+date: '2021-01-12'
+description: The following analytic identifies microsoft.workflow.compiler.exe usage.
+  microsoft.workflow.compiler.exe is natively found in C:\Windows\Microsoft.NET\Framework64\v4.0.30319
+  and is rarely utilized. When investigating, identify the executed code on disk and
+  review. It is not a commonly used process by many applications.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+type: ESCU
+references:
+- https://lolbas-project.github.io/lolbas/Binaries/Msbuild/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218/T1218.md#atomic-test-6---microsoftworkflowcompilerexe-payload-execution
+author: Michael Haag, Splunk
+search: '| tstats `security_content_summariesonly` count values(Processes.process_name)
+  as process_name values(Processes.process) as process min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=microsoft.workflow.compiler.exe
+  by Processes.dest Processes.parent_process Processes.user | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_microsoft_workflow_compiler_usage_filter`'
+known_false_positives: Although unlikely, limited instances have been identified coming
+  from native Microsoft utilities similar to SCCM.
+tags:
+  analytics_story:
+  - Trusted Developer Utilities Proxy Execution
+  mitre_attack_id:
+  - T1127
+  kill_chain_phases:
+  - Exploitation
+  cis20:
+  - CIS 8
+  nist:
+  - PR.PT
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127/windows-sysmon.log
+  automated_detection_testing: passed
diff --git a/detections/endpoint/suspicious_msbuild_path.yml b/detections/endpoint/suspicious_msbuild_path.yml
new file mode 100644
index 0000000000..1b99bd0d80
--- /dev/null
+++ b/detections/endpoint/suspicious_msbuild_path.yml
@@ -0,0 +1,44 @@
+name: Suspicious msbuild path
+id: f5198224-551c-11eb-ae93-0242ac130002
+version: 1
+date: '2021-01-12'
+description: The following analytic identifies msbuild.exe executing from a non-standard
+  path. Msbuild.exe is natively found in C:\Windows\Microsoft.NET\Framework\v4.0.30319
+  and C:\Windows\Microsoft.NET\Framework64\v4.0.30319. Instances of Visual Studio will
+  run a copy of msbuild.exe. A moved instance of MSBuild is suspicious, however there
+  are instances of build applications that will move or use a copy of MSBuild.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+type: ESCU
+references:
+- https://lolbas-project.github.io/lolbas/Binaries/Msbuild/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127.001/T1127.001.md
+author: Michael Haag, Splunk
+search: '| tstats `security_content_summariesonly` count values(Processes.process_name)
+  as process_name values(Processes.process) as process min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=msbuild.exe
+  AND (Processes.process_path!=c:\\windows\\microsoft.net\\framework*\\v*\\*)
+  by Processes.dest Processes.parent_process Processes.user | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `suspicious_msbuild_path_filter`'
+known_false_positives: Some legitimate applications may use a moved copy of msbuild.exe,
+  triggering a false positive. Baselining of MSBuild.exe usage is recommended to better
+  understand it's path usage. Visual Studio runs an instance out of a path that will need to be filtered on.
+tags:
+  analytics_story:
+  - Trusted Developer Utilities Proxy Execution MSBuild
+  mitre_attack_id:
+  - T1127.001
+  - T1036.003
+  kill_chain_phases:
+  - Exploitation
+  cis20:
+  - CIS 8
+  nist:
+  - PR.PT
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/windows-sysmon.log
+  automated_detection_testing: passed
diff --git a/detections/endpoint/suspicious_msbuild_rename.yml b/detections/endpoint/suspicious_msbuild_rename.yml
new file mode 100644
index 0000000000..f827194f4c
--- /dev/null
+++ b/detections/endpoint/suspicious_msbuild_rename.yml
@@ -0,0 +1,43 @@
+name: Suspicious MSBuild Rename
+id: 4006adac-5937-11eb-ae93-0242ac130002
+version: 1
+date: '2021-01-12'
+description: The following analytic identifies renamed instances of msbuild.exe executing.
+  Msbuild.exe is natively found in C:\Windows\Microsoft.NET\Framework\v4.0.30319 and
+  C:\Windows\Microsoft.NET\Framework64\v4.0.30319. During investigation, identify
+  the code executed and what is executing a renamed instance of MSBuild.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+type: ESCU
+references:
+- https://lolbas-project.github.io/lolbas/Binaries/Msbuild/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127.001/T1127.001.md
+- https://github.com/infosecn1nja/MaliciousMacroMSBuild/
+author: Michael Haag, Splunk
+search: '`sysmon` EventID=1 (OriginalFileName=msbuild.exe OR process_name=msbuild.exe)
+  | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User,
+  parent_process_name, process_name, OriginalFileName, process_path, CommandLine |
+  rename Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
+  `suspicious_msbuild_rename_filter`'
+known_false_positives: Although unlikely, some legitimate applications may use a moved
+  copy of msbuild, triggering a false positive.
+tags:
+  analytics_story:
+  - Trusted Developer Utilities Proxy Execution MSBuild
+  mitre_attack_id:
+  - T1127.001
+  - T1036.003
+  kill_chain_phases:
+  - Exploitation
+  cis20:
+  - CIS 8
+  nist:
+  - PR.PT
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/windows-sysmon.log
+  automated_detection_testing: passed
diff --git a/detections/endpoint/suspicious_msbuild_spawn.yml b/detections/endpoint/suspicious_msbuild_spawn.yml
new file mode 100644
index 0000000000..49a37d6b5a
--- /dev/null
+++ b/detections/endpoint/suspicious_msbuild_spawn.yml
@@ -0,0 +1,44 @@
+name: Suspicious MSBuild Spawn
+id: a115fba6-5514-11eb-ae93-0242ac130002
+version: 1
+date: '2021-01-12'
+description: The following analytic identifies wmiprvse.exe spawning msbuild.exe.
+  This behavior is indicative of a COM object being utilized to spawn msbuild from
+  wmiprvse.exe. It is common for MSBuild.exe to be spawned from devenv.exe while using
+  Visual Studio. In this instance, there will be command line arguments and file paths.
+  In a malicious instance, MSBuild.exe will spawn from non-standard processes and
+  have no command line arguments. For example, MSBuild.exe spawning from explorer.exe,
+  powershell.exe is far less common and should be investigated.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+type: ESCU
+references:
+- https://lolbas-project.github.io/lolbas/Binaries/Msbuild/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127.001/T1127.001.md
+author: Michael Haag, Splunk
+search: '| tstats `security_content_summariesonly` count values(Processes.process_name)
+  as process_name values(Processes.process) as process min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=wmiprvse.exe
+  AND Processes.process_name=msbuild.exe by Processes.dest Processes.parent_process
+  Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `suspicious_msbuild_spawn_filter`'
+known_false_positives: Although unlikely, some legitimate applications may exhibit
+  this behavior, triggering a false positive.
+tags:
+  analytics_story:
+  - Trusted Developer Utilities Proxy Execution MSBuild
+  mitre_attack_id:
+  - T1127.001
+  kill_chain_phases:
+  - Exploitation
+  cis20:
+  - CIS 8
+  nist:
+  - PR.PT
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/windows-sysmon.log
+  automated_detection_testing: passed
diff --git a/detections/endpoint/suspicious_mshta_child_process.yml b/detections/endpoint/suspicious_mshta_child_process.yml
new file mode 100644
index 0000000000..bf483827dd
--- /dev/null
+++ b/detections/endpoint/suspicious_mshta_child_process.yml
@@ -0,0 +1,46 @@
+name: Suspicious mshta child process
+id: 60023bb6-5500-11eb-ae93-0242ac130002
+version: 1
+date: '2021-01-12'
+description: The following analytic identifies child processes spawning from  "mshta.exe".
+  The search will return the first time and last time these command-line arguments
+  were used for these executions, as well as the target system, the user, parent process
+  "mshta.exe" and its child process.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+type: ESCU
+references:
+- https://github.com/redcanaryco/AtomicTestHarnesses
+- https://redcanary.com/blog/introducing-atomictestharnesses/
+author: Michael Haag, Splunk
+search: '| tstats `security_content_summariesonly` count values(Processes.process_name)
+  as process_name values(Processes.process) as process min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=mshta.exe
+  AND (Processes.process_name=powershell.exe OR Processes.process_name=colorcpl.exe
+  OR Processes.process_name=msbuild.exe OR Processes.process_name=microsoft.workflow.compiler.exe
+  OR Processes.process_name=searchprotocolhost.exe OR Processes.process_name=scrcons.exe
+  OR Processes.process_name=cscript.exe OR Processes.process_name=wscript.exe OR Processes.process_name=powershell.exe
+  OR Processes.process_name=cmd.exe) by Processes.dest Processes.parent_process Processes.user
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `suspicious_mshta_child_process_filter`'
+known_false_positives: Although unlikely, some legitimate applications may exhibit
+  this behavior, triggering a false positive.
+tags:
+  analytics_story:
+  - Suspicious MSHTA Activity
+  mitre_attack_id:
+  - T1218.005
+  kill_chain_phases:
+  - Exploitation
+  cis20:
+  - CIS 8
+  nist:
+  - PR.PT
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log
+  automated_detection_testing: passed
diff --git a/detections/endpoint/suspicious_mshta_spawn.yml b/detections/endpoint/suspicious_mshta_spawn.yml
new file mode 100644
index 0000000000..334f896bd6
--- /dev/null
+++ b/detections/endpoint/suspicious_mshta_spawn.yml
@@ -0,0 +1,42 @@
+name: Suspicious mshta spawn
+id: 4d33a488-5b5f-11eb-ae93-0242ac130002
+version: 1
+date: '2021-01-20'
+description: The following analytic identifies wmiprvse.exe spawning mshta.exe. This
+  behavior is indicative of a DCOM object being utilized to spawn mshta from wmiprvse.exe
+  or svchost.exe. In this instance, adversaries may use LethalHTA that will spawn
+  mshta.exe from svchost.exe.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+type: ESCU
+references:
+- https://codewhitesec.blogspot.com/2018/07/lethalhta.html
+- https://github.com/redcanaryco/AtomicTestHarnesses
+- https://redcanary.com/blog/introducing-atomictestharnesses/
+author: Michael Haag, Splunk
+search: '| tstats `security_content_summariesonly` count values(Processes.process_name)
+  as process_name values(Processes.process) as process min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name=svchost.exe
+  OR Processes.parent_process_name=wmiprvse.exe) AND Processes.process_name=mshta.exe
+  by Processes.dest Processes.parent_process Processes.user | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_mshta_spawn_filter`'
+known_false_positives: Although unlikely, some legitimate applications may exhibit
+  this behavior, triggering a false positive.
+tags:
+  analytics_story:
+  - Suspicious MSHTA Activity
+  mitre_attack_id:
+  - T1218.005
+  kill_chain_phases:
+  - Exploitation
+  cis20:
+  - CIS 8
+  nist:
+  - PR.PT
+  - DE.CM
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log
+  automated_detection_testing: passed
diff --git a/detections/endpoint/wbadmin_delete_system_backups.yml b/detections/endpoint/wbadmin_delete_system_backups.yml
new file mode 100644
index 0000000000..3999fe577e
--- /dev/null
+++ b/detections/endpoint/wbadmin_delete_system_backups.yml
@@ -0,0 +1,41 @@
+name: WBAdmin Delete System Backups
+id: cd5aed7e-5cea-11eb-ae93-0242ac130002
+version: 1
+date: '2021-01-22'
+description: This search looks for flags passed to wbadmin.exe (Windows Backup Administrator
+  Tool) that delete backup files. This is typically used by ransomware to prevent
+  recovery.
+how_to_implement: You must be ingesting endpoint data that tracks process activity,
+  including parent-child relationships from your endpoints to populate the Endpoint
+  data model in the Processes node. Tune based on parent process names.
+type: ESCU
+references:
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md
+- https://thedfirreport.com/2020/10/08/ryuks-return/
+- https://attack.mitre.org/techniques/T1490/
+- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin
+author: Michael Haag, Splunk
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=wbadmin.exe
+  Processes.process="*delete*" AND (Processes.process="*catalog*" OR Processes.process="*systemstatebackup*")
+  by Processes.process_name Processes.process Processes.parent_process_name Processes.dest
+  Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`| `wbadmin_delete_system_backups_filter`'
+known_false_positives: Administrators may modify the boot configuration.
+tags:
+  analytics_story:
+  - Ryuk Ransomware
+  - Ransomware
+  mitre_attack_id:
+  - T1490
+  kill_chain_phases:
+  - Actions on Objectives
+  cis20:
+  - CIS 8
+  nist:
+  - PR.IP
+  security_domain: endpoint
+  asset_type: Endpoint
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log
+  automated_detection_testing: passed
diff --git a/stories/suspicious_mshta_activity.yml b/stories/suspicious_mshta_activity.yml
index 9912ec9be1..d08c86333a 100644
--- a/stories/suspicious_mshta_activity.yml
+++ b/stories/suspicious_mshta_activity.yml
@@ -1,29 +1,38 @@
 name: Suspicious MSHTA Activity
 id: 2b1800dd-92f9-47dd-a981-fdf13w1q5d55
-version: 1
-date: '2020-02-03'
+version: 2
+date: '2021-01-20'
 description: Monitor and detect techniques used by attackers who leverage the mshta.exe
   process to execute malicious code.
-narrative: 'One common adversary tactic is to bypass application allow listing solutions
-  via the mshta.exe process, which executes Microsoft HTML applications with the .hta
-  suffix. In these cases, attackers use the trusted Windows utility to eproxy execution
+narrative: 'One common adversary tactic is to bypass application white-listing solutions
+  via the mshta.exe process, which loads Microsoft HTML applications (mshtml.dll) with the .hta
+  suffix. In these cases, attackers use the trusted Windows utility to proxy execution
   of malicious files, whether an .hta application, javascript, or VBScript.\
 
-  One example of a notable mshta.exe attack was the Kovter malware (https://medium.com/@mbromileyDFIR/malware-monday-aebb456356c5)
-  that was implicated in ransomware and click-fraud attacks. Kovter utilized .hta
-  to execute a series of javascript commands, each progressively more dangerous. According
-  to the Mitre Parternship Network (https://attack.mitre.org/wiki/Technique/T1170),
-  FIN7 has leveraged mshta.exe, as has the MuddyWater group, who used it to execute
-  its POWERSTATS payload (which then used the utility to execute additional payloads).\
-
   The searches in this story help you detect and investigate suspicious activity that
-  may indicate that an attacker is leveraging mshta.exe to execute malicious code.'
-author: Bhavin Patel, Splunk
+  may indicate that an attacker is leveraging mshta.exe to execute malicious code. \
+  
+  Triage \
+  Validate execution \
+  1. Determine if MSHTA.exe executed. Validate the OriginalFileName of MSHTA.exe and further
+  PE metadata. If executed outside of c:\windows\system32 or c:\windows\syswow64, it should be highly suspect.
+  2. Determine if script code was executed with MSHTA. \
+  Situational Awareness \
+  The objective of this step is meant to identify suspicious behavioral indicators related to executed of 
+  Script code by MSHTA.exe. \
+  1. Parent process. Is the parent process a known LOLBin? Is the parent process an Office Application? 
+  2. Module loads. Are the known MSHTA.exe modules being loaded by a non-standard application? Is
+  MSHTA loading any suspicious .DLLs?
+  3. Network connections. Any network connections? Review the reputation of the remote IP or domain. \
+  Retrieval of script code \
+  The objective of this step is to confirm the executed script code is benign or malicious.'
+author: Bhavin Patel, Michael Haag, Splunk
 type: ESCU
 references:
+- https://redcanary.com/blog/introducing-atomictestharnesses/
 - https://redcanary.com/blog/windows-registry-attacks-threat-detection/
+- https://attack.mitre.org/techniques/T1218/005/
 - https://medium.com/@mbromileyDFIR/malware-monday-aebb456356c5
-- https://attack.mitre.org/wiki/Technique/T1170
 tags:
   analytics_story: Suspicious MSHTA Activity
   usecase: Advanced Threat Detection
diff --git a/stories/trusted_developer_utilities_proxy_execution.yml b/stories/trusted_developer_utilities_proxy_execution.yml
new file mode 100644
index 0000000000..9c9041e846
--- /dev/null
+++ b/stories/trusted_developer_utilities_proxy_execution.yml
@@ -0,0 +1,27 @@
+name: Trusted Developer Utilities Proxy Execution
+id: 270a67a6-55d8-11eb-ae93-0242ac130002
+version: 1
+date: '2021-01-12'
+description: Monitor and detect behaviors used by attackers who leverage trusted developer utilities
+  to execute malicious code.
+narrative: 'Adversaries may take advantage of trusted developer utilities to proxy
+  execution of malicious payloads. There are many utilities used for software development
+  related tasks that can be used to execute code in various forms to assist in development,
+  debugging, and reverse engineering. These utilities may often be signed with
+  legitimate certificates that allow them to execute on a system and proxy execution of
+  malicious code through a trusted process that effectively bypasses application control solutions.\
+
+  The searches in this story help you detect and investigate suspicious activity that
+  may indicate that an adversary is leveraging microsoft.workflow.compiler.exe to execute 
+  malicious code.'
+author: Michael Haag, Splunk
+type: ESCU
+references:
+- https://attack.mitre.org/techniques/T1127/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218/T1218.md
+- https://lolbas-project.github.io/lolbas/Binaries/Microsoft.Workflow.Compiler/
+tags:
+  analytics_story: Trusted Developer Utilities Proxy Execution
+  usecase: Advanced Threat Detection
+  category:
+  - Adversary Tactics
\ No newline at end of file
diff --git a/stories/trusted_developer_utilities_proxy_execution_msbuild.yml b/stories/trusted_developer_utilities_proxy_execution_msbuild.yml
new file mode 100644
index 0000000000..355aa38376
--- /dev/null
+++ b/stories/trusted_developer_utilities_proxy_execution_msbuild.yml
@@ -0,0 +1,48 @@
+name: Trusted Developer Utilities Proxy Execution MSBuild
+id: be3418e2-551b-11eb-ae93-0242ac130002
+version: 1
+date: '2021-01-21'
+description: Monitor and detect techniques used by attackers who leverage the msbuild.exe
+  process to execute malicious code.
+narrative: 'Adversaries may use MSBuild to proxy execution of code through a trusted 
+  Windows utility. MSBuild.exe (Microsoft Build Engine) is a software build platform
+  used by Visual Studio and is native to Windows. It handles XML formatted project
+  files that define requirements for loading and building various platforms and configurations. \
+
+  The inline task capability of MSBuild that was introduced in .NET version 4 allows
+  for C# code to be inserted into an XML project file. MSBuild will compile and
+  execute the inline task. MSBuild.exe is a signed Microsoft binary, so when it is
+  used this way it can execute arbitrary code and bypass application control defenses
+  that are configured to allow MSBuild.exe execution. \
+
+  The searches in this story help you detect and investigate suspicious activity that
+  may indicate that an adversary is leveraging msbuild.exe to execute malicious code. \
+  
+  Triage \
+  Validate execution \
+  1. Determine if MSBuild.exe executed. Validate the OriginalFileName of MSBuild.exe and further
+  PE metadata.
+  2. Determine if script code was executed with MSBuild.
+  Situational Awareness \
+  The objective of this step is meant to identify suspicious behavioral indicators related to executed of 
+  Script code by MSBuild.exe. \
+  1. Parent process. Is the parent process a known LOLBin? Is the parent process an Office Application? 
+  2. Module loads. Are the known MSBuild.exe modules being loaded by a non-standard application? Is
+  MSbuild loading any suspicious .DLLs?
+  3. Network connections. Any network connections? Review the reputation of the remote IP or domain. \
+  Retrieval of script code \
+  The objective of this step is to confirm the executed script code is benign or malicious.'
+author: Michael Haag, Splunk
+type: ESCU
+references:
+- https://attack.mitre.org/techniques/T1127/001/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127.001/T1127.001.md
+- https://github.com/infosecn1nja/MaliciousMacroMSBuild
+- https://github.com/xorrior/RandomPS-Scripts/blob/master/Invoke-ExecuteMSBuild.ps1
+- https://lolbas-project.github.io/lolbas/Binaries/Msbuild/
+- https://github.com/MHaggis/CBR-Queries/blob/master/msbuild.md
+tags:
+  analytics_story: Trusted Developer Utilities Proxy Execution MSBuild
+  usecase: Advanced Threat Detection
+  category:
+  - Adversary Tactics
\ No newline at end of file
diff --git a/tests/endpoint/detect_mshta_exe_running_scripts_in_command_line_arguments.test.yml b/tests/endpoint/detect_mshta_exe_running_scripts_in_command_line_arguments.test.yml
index ae75a6fcfd..3f7168eb70 100644
--- a/tests/endpoint/detect_mshta_exe_running_scripts_in_command_line_arguments.test.yml
+++ b/tests/endpoint/detect_mshta_exe_running_scripts_in_command_line_arguments.test.yml
@@ -1,7 +1,7 @@
-name: Detect mshta exe running scripts in command-line arguments Unit Test
+name: Detect mshta inline hta execution Unit Test
 tests:
-- name: Detect mshta exe running scripts in command-line arguments
-  file: endpoint/detect_mshta_exe_running_scripts_in_command_line_arguments.yml
+- name: Detect mshta executing inline protocol handlers
+  file: endpoint/detect_mshta_inline_hta_execution.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'
diff --git a/tests/endpoint/detect_mshta_url_in_command_line.test.yml b/tests/endpoint/detect_mshta_url_in_command_line.test.yml
new file mode 100644
index 0000000000..82922a6f94
--- /dev/null
+++ b/tests/endpoint/detect_mshta_url_in_command_line.test.yml
@@ -0,0 +1,12 @@
+name: Detect mshta url in command line test
+tests:
+- name: Detect mshta url in command line
+  file: endpoint/detect_mshta_url_in_command_line.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file
diff --git a/tests/endpoint/detect_rundll32_inline_hta_execution.test.yml b/tests/endpoint/detect_rundll32_inline_hta_execution.test.yml
new file mode 100644
index 0000000000..9db91e1c52
--- /dev/null
+++ b/tests/endpoint/detect_rundll32_inline_hta_execution.test.yml
@@ -0,0 +1,12 @@
+name: Detect rundll32 inline hta execution Test
+tests:
+- name: Detect rundll32 executing hta with inline protocols
+  file: endpoint/detect_rundll32_inline_hta_execution.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
diff --git a/tests/endpoint/nltest_domain_trust_discovery.test.yml b/tests/endpoint/nltest_domain_trust_discovery.test.yml
new file mode 100644
index 0000000000..92fd95983a
--- /dev/null
+++ b/tests/endpoint/nltest_domain_trust_discovery.test.yml
@@ -0,0 +1,12 @@
+name: NLTest Domain Trust Discovery
+tests:
+- name: NLTest Domain Trust Discovery
+  file: endpoint/nltest_domain_trust_discovery.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1482/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file
diff --git a/tests/endpoint/suspicious_microsoft_workflow_compiler_rename.test.yml b/tests/endpoint/suspicious_microsoft_workflow_compiler_rename.test.yml
new file mode 100644
index 0000000000..eecb9688ea
--- /dev/null
+++ b/tests/endpoint/suspicious_microsoft_workflow_compiler_rename.test.yml
@@ -0,0 +1,12 @@
+name: Suspicious microsoft workflow compiler rename
+tests:
+- name: Detect microsoft.workflow.compiler.exe rename
+  file: endpoint/suspicious_microsoft_workflow_compiler_rename.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
diff --git a/tests/endpoint/suspicious_microsoft_workflow_compiler_usage.test.yml b/tests/endpoint/suspicious_microsoft_workflow_compiler_usage.test.yml
new file mode 100644
index 0000000000..6593f91cb4
--- /dev/null
+++ b/tests/endpoint/suspicious_microsoft_workflow_compiler_usage.test.yml
@@ -0,0 +1,12 @@
+name: Suspicious microsoft workflow compiler usage
+tests:
+- name: Detect microsoft.workflow.compiler.exe usage
+  file: endpoint/suspicious_microsoft_workflow_compiler_usage.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
diff --git a/tests/endpoint/suspicious_msbuild_path.test.yml b/tests/endpoint/suspicious_msbuild_path.test.yml
new file mode 100644
index 0000000000..fa5e080c6b
--- /dev/null
+++ b/tests/endpoint/suspicious_msbuild_path.test.yml
@@ -0,0 +1,13 @@
+name: Suspicious msbuild path
+tests:
+- name: Detect moved msbuild execution
+  file: endpoint/suspicious_msbuild_path.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: True
\ No newline at end of file
diff --git a/tests/endpoint/suspicious_msbuild_rename.test.yml b/tests/endpoint/suspicious_msbuild_rename.test.yml
new file mode 100644
index 0000000000..be713ce446
--- /dev/null
+++ b/tests/endpoint/suspicious_msbuild_rename.test.yml
@@ -0,0 +1,13 @@
+name: Suspicious msbuild rename
+tests:
+- name: Detect renamed msbuild execution
+  file: endpoint/suspicious_msbuild_rename.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: True
\ No newline at end of file
diff --git a/tests/endpoint/suspicious_msbuild_spawn.test.yml b/tests/endpoint/suspicious_msbuild_spawn.test.yml
new file mode 100644
index 0000000000..498fd7134d
--- /dev/null
+++ b/tests/endpoint/suspicious_msbuild_spawn.test.yml
@@ -0,0 +1,13 @@
+name: Suspicious msbuild spawn
+tests:
+- name: Detect wmiprvse spawn msbuild
+  file: endpoint/suspicious_msbuild_spawn.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: True
\ No newline at end of file
diff --git a/tests/endpoint/suspicious_mshta_child_process.test.yml b/tests/endpoint/suspicious_mshta_child_process.test.yml
new file mode 100644
index 0000000000..531fb31e71
--- /dev/null
+++ b/tests/endpoint/suspicious_mshta_child_process.test.yml
@@ -0,0 +1,13 @@
+name: Suspicious mshta child process Unit Test
+tests:
+- name: Detect mshta spawning a process
+  file: endpoint/suspicious_mshta_child_process.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-7d'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: True
\ No newline at end of file
diff --git a/tests/endpoint/suspicious_mshta_spawn.test.yml b/tests/endpoint/suspicious_mshta_spawn.test.yml
new file mode 100644
index 0000000000..0acbd71f95
--- /dev/null
+++ b/tests/endpoint/suspicious_mshta_spawn.test.yml
@@ -0,0 +1,12 @@
+name: Detect mshta spawn unit test
+tests:
+- name: Detect mshta spawn
+  file: endpoint/suspicious_mshta_spawn.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file
diff --git a/tests/endpoint/wbadmin_delete_system_backups.test.yml b/tests/endpoint/wbadmin_delete_system_backups.test.yml
new file mode 100644
index 0000000000..6f9988cd24
--- /dev/null
+++ b/tests/endpoint/wbadmin_delete_system_backups.test.yml
@@ -0,0 +1,12 @@
+name: WBAdmin Delete System Backups Unit Test
+tests:
+- name: WBAdmin Delete System Backups
+  file: endpoint/wbadmin_delete_system_backups.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog